perf(migrations): build vuln-id index + unique constraint concurrently (F9)

0280's lookup index and 0282's (finding, vulnerability_id) unique constraint
were built with plain AddIndex / AddConstraint, taking a SHARE lock (blocks
writes) and an ACCESS EXCLUSIVE lock (blocks reads+writes) for the full build
over the whole dojo_vulnerability_id table -- a material downtime window on
large instances.

Build both CONCURRENTLY instead (atomic=False), keeping the work in-migration:
- 0280: AddIndexConcurrently for dojo_vuln_id_lookup_idx.
- 0282: CREATE UNIQUE INDEX CONCURRENTLY, then ADD CONSTRAINT ... USING INDEX
  (brief lock to adopt the pre-built index); SeparateDatabaseAndState keeps the
  UniqueConstraint in Django's model state.

Verified on a 100k-finding / 174k-id dataset with duplicate rows: 0281 dedupe
-> 0, constraint built valid as a real UNIQUE constraint, makemigrations
--check clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Maffooch

dojo/db_migrations/0280_vulnerability_id_type.py

@@ -1,12 +1,22 @@
+from django.contrib.postgres.operations import AddIndexConcurrently
 from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
 
-    """Schema only: add the autodetected vulnerability_id_type column and a leading index on
-    vulnerability_id. The data backfill (0277) and the unique constraint (0278, which requires
+    """
+    Schema only: add the autodetected vulnerability_id_type column and a leading index on
+    vulnerability_id. The data backfill (0281) and the unique constraint (0282, which requires
     the dedupe data step first) are kept in separate migrations so data migrations are never
-    mixed with schema migrations."""
+    mixed with schema migrations.
+
+    The lookup index is built with CREATE INDEX CONCURRENTLY (no SHARE lock, so writes to
+    dojo_vulnerability_id keep flowing during the build), which requires a non-atomic migration.
+    Adding the nullable, all-NULL vulnerability_id_type column and its own index is a fast catalog
+    operation, so it stays a plain AddField.
+    """
+
+    atomic = False
 
     dependencies = [
         ("dojo", "0279_jira_project_transition_fields"),
@@ -18,7 +28,7 @@ class Migration(migrations.Migration):
             name="vulnerability_id_type",
             field=models.CharField(blank=True, db_index=True, editable=False, max_length=20, null=True),
         ),
-        migrations.AddIndex(
+        AddIndexConcurrently(
             model_name="vulnerability_id",
             index=models.Index(fields=["vulnerability_id"], name="dojo_vuln_id_lookup_idx"),
         ),

dojo/db_migrations/0282_unique_finding_vulnerability_id.py

@@ -3,16 +3,41 @@
 
 class Migration(migrations.Migration):
 
-    """Schema only: add the (finding, vulnerability_id) unique constraint. Runs after the 0277
-    dedupe data step so the constraint can be created without violating existing duplicate rows."""
+    """
+    Schema only: add the (finding, vulnerability_id) unique constraint. Runs after the 0281
+    dedupe data step so the constraint can be created without violating existing duplicate rows.
+
+    The unique index is built with CREATE UNIQUE INDEX CONCURRENTLY (no ACCESS EXCLUSIVE
+    full-build lock, so reads and writes keep flowing during the build) and then attached as the
+    constraint with ADD CONSTRAINT ... USING INDEX, which only takes a brief lock to adopt the
+    already-built index. Both steps run inside this migration; CONCURRENTLY requires atomic=False.
+    """
+
+    atomic = False
 
     dependencies = [
         ("dojo", "0281_backfill_vulnerability_id_type"),
     ]
 
     operations = [
-        migrations.AddConstraint(
-            model_name="vulnerability_id",
-            constraint=models.UniqueConstraint(fields=("finding", "vulnerability_id"), name="unique_finding_vulnerability_id"),
+        migrations.RunSQL(
+            sql="CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS unique_finding_vulnerability_id "
+                "ON dojo_vulnerability_id (finding_id, vulnerability_id);",
+            reverse_sql="DROP INDEX CONCURRENTLY IF EXISTS unique_finding_vulnerability_id;",
+        ),
+        migrations.SeparateDatabaseAndState(
+            database_operations=[
+                migrations.RunSQL(
+                    sql="ALTER TABLE dojo_vulnerability_id ADD CONSTRAINT unique_finding_vulnerability_id "
+                        "UNIQUE USING INDEX unique_finding_vulnerability_id;",
+                    reverse_sql="ALTER TABLE dojo_vulnerability_id DROP CONSTRAINT IF EXISTS unique_finding_vulnerability_id;",
+                ),
+            ],
+            state_operations=[
+                migrations.AddConstraint(
+                    model_name="vulnerability_id",
+                    constraint=models.UniqueConstraint(fields=("finding", "vulnerability_id"), name="unique_finding_vulnerability_id"),
+                ),
+            ],
         ),
     ]