Do not create audit event for failed logins on read-only DB

Changelog: fixed
EE: true

ee/app/services/ee/audit_event_service.rb

@@ -133,7 +133,7 @@ module EE
     # @return [AuditEvent, nil] if record is persisted or nil if audit events
     #   features are not enabled
     def unauth_security_event
-      return unless audit_events_enabled?
+      return unless audit_events_enabled? && ::Gitlab::Database.read_write?
 
       add_security_event_admin_details!
 

ee/spec/services/audit_event_service_spec.rb

@@ -333,6 +333,16 @@ RSpec.describe AuditEventService, :request_store do
         expect(event.details).not_to have_key(:ip_address)
       end
     end
+
+    context 'on a read-only instance' do
+      before do
+        allow(Gitlab::Database).to receive(:read_only?).and_return(true)
+      end
+
+      it 'does not create an event record in the database' do
+        expect { service.for_failed_login.unauth_security_event }.not_to change(AuditEvent, :count)
+      end
+    end
   end
 
   describe '#for_project_group_link' do