chore(aci milestone 3): open period -> incident serializer

[mifu67]

Previously, this serializer took in an open period, fetched the incident via the IGOP lookup table, and serialized the incident. With the incident no longer guaranteed to exist, create a serializer that will populate an incident response using only the open period model.

[semgrep-code-getsentry]

High severity vulnerability may affect your project—review required:
Line 73 lists a dependency (django) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of Django are vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). SQL injection in Django's ORM column aliases: when using QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), or QuerySet.extra() with dictionary expansion (**kwargs), the dictionary keys are used unescaped as SQL column aliases. On MySQL and MariaDB backends, an attacker who can influence those keys (for example, by passing a crafted dict of annotations) can inject arbitrary SQL into the generated query.

References: GHSA, CVE

To resolve this comment:
Check if you are using Django with MySQL or MariaDB.

• If you're affected, upgrade this dependency to at least version 5.2.7 at uv.lock.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[codecov]

Codecov Report

❌ Patch coverage is 96.61017% with 2 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
.../endpoints/serializers/workflow_engine_incident.py	96.61%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #103131      +/-   ##
===========================================
+ Coverage   78.93%    80.67%   +1.74%     
===========================================
  Files        9137      9145       +8     
  Lines      392766    393299     +533     
  Branches    24966     24966              
===========================================
+ Hits       310027    317313    +7286     
+ Misses      82338     75585    -6753     
  Partials      401       401              

[mifu67]

Technically, this should be obj.date_started - one snuba time window. I felt that introducing the snuba stuff to a serializer that doesn't use it elsewhere was unnecessarily complicated. Same for dateClosed.

[cursor]

Bug: Missing Data Breaks Group Processing

The get_open_periods_to_detectors method raises a KeyError when a group lacks a DetectorGroup record. Line 129 accesses groups_to_detectors[group] without checking if the key exists, which only contains groups with existing DetectorGroup relationships from the database query. This causes the serializer to fail for groups without detectors instead of gracefully handling the missing relationship.

 

[ceorourke]

Fair, I suppose we can check for the existence first before adding to the dict

[ceorourke]

@mifu67 did you wanna address this?

[ceorourke]

Overall looks good. Agree w/ one of the bot comments + a little test nit

[ceorourke]

Fair, I suppose we can check for the existence first before adding to the dict

[cursor]

Bug: Data discovery crashes with no available sources.

The _build_discover_query method raises an unhandled IndexError when data_source_detector.detector.data_sources.all() returns an empty queryset. The code accesses [0] without checking if the queryset has elements, and the QuerySubscription.DoesNotExist exception handler doesn't catch IndexError, causing the serializer to crash instead of returning an empty string.

src/sentry/incidents/endpoints/serializers/workflow_engine_incident.py#L182-L189

sentry/src/sentry/incidents/endpoints/serializers/workflow_engine_incident.py

Lines 182 to 189 in c9f7f8b

	# The query we should use to get accurate results in Discover.
	return DetailedIncidentSerializerResponse(
	**base_context, discoverQuery=self._build_discover_query(obj)
	)
	def _build_discover_query(self, open_period: GroupOpenPeriod) -> str:
	detector = self.get_open_periods_to_detectors([open_period])[open_period]
	try:

 

---