Merge branch 'mw/handle-scoped-actors-ff-event-streaming-rollout' into 'master'

Fix audit event streaming rollout actors

See merge request gitlab-org/gitlab!74513

ee/app/models/ee/audit_event.rb

@@ -56,8 +56,8 @@ module EE
 
     def stream_to_external_destinations
       return if entity.nil?
-      return unless ::Feature.enabled?(:ff_external_audit_events_namespace, entity)
-      return unless entity.licensed_feature_available?(:external_audit_events)
+      return unless ::Feature.enabled?(:ff_external_audit_events_namespace, group_entity)
+      return unless group_entity.licensed_feature_available?(:external_audit_events)
 
       AuditEvents::AuditEventStreamingWorker.perform_async(id)
     end
@@ -68,6 +68,19 @@ module EE
 
     private
 
+    def group_entity
+      case entity_type
+      when 'Group'
+        entity
+      when 'Project'
+        # Project events should be sent to the root ancestor's streaming destinations
+        # Projects without a group root ancestor should be ignored.
+        entity.group&.root_ancestor
+      else
+        nil
+      end
+    end
+
     def truncate_fields
       TRUNCATED_FIELDS.each do |name, limit|
         original = self[name] || self.details[name]

ee/spec/models/ee/audit_event_spec.rb

@@ -86,6 +86,36 @@ RSpec.describe AuditEvent, type: :model do
         stub_licensed_features(external_audit_events: true)
       end
 
+      context 'entity is a project' do
+        let_it_be(:group) { create(:group, :nested) }
+        let_it_be(:project) { create(:project, group: group) }
+        let_it_be(:event) { create(:audit_event, :project_event, target_project: project) }
+
+        context 'when ff_external_audit_events_namespace is enabled' do
+          before do
+            stub_feature_flags(ff_external_audit_events_namespace: group.root_ancestor)
+          end
+
+          it 'enqueues one worker' do
+            expect(AuditEvents::AuditEventStreamingWorker).to receive(:perform_async).once
+
+            event.stream_to_external_destinations
+          end
+        end
+
+        context 'when ff_external_audit_events_namespace is disabled' do
+          before do
+            stub_feature_flags(ff_external_audit_events_namespace: false)
+          end
+
+          it 'enqueues no workers' do
+            expect(AuditEvents::AuditEventStreamingWorker).not_to receive(:perform_async)
+
+            event.stream_to_external_destinations
+          end
+        end
+      end
+
       it 'enqueues one worker' do
         expect(AuditEvents::AuditEventStreamingWorker).to receive(:perform_async).once
 

spec/requests/api/project_import_spec.rb

@@ -47,7 +47,7 @@ RSpec.describe API::ProjectImport do
     it 'executes a limited number of queries' do
       control_count = ActiveRecord::QueryRecorder.new { subject }.count
 
-      expect(control_count).to be <= 101
+      expect(control_count).to be <= 102
     end
 
     it 'schedules an import using a namespace' do