Sort all vulnerability history keys

Only the :total key for vulnerability history is being sorted. This
causes the graphing to potentially be off for the individual severities

ee/lib/gitlab/vulnerabilities/history.rb

@@ -32,14 +32,19 @@ module Gitlab
 
         project_ids_to_fetch.each do |project_id|
           project_history = Gitlab::Vulnerabilities::HistoryCache.new(group, project_id).fetch(HISTORY_RANGE)
-          history_keys = ::Vulnerabilities::Occurrence::SEVERITY_LEVELS.keys.map(&:to_sym)
-          history_keys << :total
-          history_keys.each do |key|
-            history[key].merge!(project_history[key]) { |k, aggregate, project_count| aggregate + project_count }
+          history.each do |key, value|
+            value.merge!(project_history[key]) { |k, aggregate, project_count| aggregate + project_count }
           end
         end
 
-        history[:total] = history[:total].sort_by { |date, count| date }.to_h
+        sort_by_date_for_each_key(history)
+      end
+
+      def sort_by_date_for_each_key(history)
+        history.each do |key, value|
+          history[key] = value.sort_by { |date, count| date }.to_h
+        end
+
         history
       end
 

ee/spec/lib/gitlab/vulnerabilities/history_spec.rb

@@ -28,10 +28,12 @@ describe Gitlab::Vulnerabilities::History do
       end
 
       it 'returns the proper format for the history' do
+        Timecop.freeze do
           expect(counter[:total]).to eq({ Date.today => 3 })
           expect(counter[:high]).to eq({ Date.today => 2 })
         end
       end
+    end
 
     context 'feature enabled' do
       before do
@@ -55,16 +57,36 @@ describe Gitlab::Vulnerabilities::History do
       end
 
       it 'returns the proper format for the history' do
+        Timecop.freeze do
           expect(counter[:total]).to eq({ Date.today => 3 })
           expect(counter[:high]).to eq({ Date.today => 2 })
         end
       end
 
+      context 'multiple projects with vulnerabilities' do
+        before do
+          Timecop.freeze(Date.today - 1) do
+            create_vulnerabilities(1, project1, { severity: :high })
+          end
+          Timecop.freeze(Date.today - 4) do
+            create_vulnerabilities(1, project2, { severity: :high })
+          end
+        end
+
+        it 'sorts by date for each key' do
+          Timecop.freeze do
+            expect(counter[:high].keys).to eq([(Date.today - 4), (Date.today - 1), Date.today])
+          end
+        end
+      end
+    end
+
     def create_vulnerabilities(count, project, options = {})
       report_type = options[:report_type] || :sast
       severity = options[:severity] || :high
       pipeline = create(:ci_pipeline, :success, project: project)
-      create_list(:vulnerabilities_occurrence, count, report_type: report_type, severity: severity, pipelines: [pipeline], project: project)
+      created_at = options[:created_at] || Date.today
+      create_list(:vulnerabilities_occurrence, count, report_type: report_type, severity: severity, pipelines: [pipeline], project: project, created_at: created_at)
     end
   end
 end