perf(tags): skip redundant inheritance on no-change reimport

Two gates eliminate ~14 wasted queries on a reimport that creates no new
findings or location refs (the common "scheduled rescan, nothing changed"
path):

1. `DefaultReImporter.process_findings` now tracks newly-created findings
   in `new_findings_in_batch` (populated in the else branch of the
   matched/unmatched dispatch) and passes ONLY those to
   `apply_inherited_tags_for_findings`. Matched/existing findings already
   had inheritance applied at their original creation, so re-running the
   through-table read + Location prefetch chain on them is pure overhead.

2. `LocationManager._persist_locations` now skips
   `apply_inherited_tags_for_locations` when no new `LocationProductReference`
   rows were created. New `LocationFindingReference`s only add findings
   within `self._product`, so they can't change a Location's Product
   membership; only a new product ref can. When `all_product_refs` is empty,
   the Location's inherited target set is unchanged and the helper would do
   a costly no-op read for nothing.

Net effect on the pinned ZAP reimport-no-change baselines:
- V2: 75 → 69 (matches the pre-Phase-A baseline of 69)
- V3: 101 → 81 (beats the pre-Phase-A baseline of 87)

Author: valentijnscholten

dojo/importers/default_reimporter.py

@@ -317,6 +317,11 @@ def _process_findings_internal(
 
         batch_finding_ids: list[int] = []
         batch_findings: list[Finding] = []
+        # Findings that were newly created (else branch below) — pass these to
+        # `apply_inherited_tags_for_findings` instead of `batch_findings` so
+        # matched/existing findings (which already have correct inherited tags)
+        # don't trigger a redundant through-table read on no-change reimports.
+        new_findings_in_batch: list[Finding] = []
         findings_with_parser_tags: list[tuple] = []
         # Batch size for deduplication/post-processing (only new findings)
         dedupe_batch_max_size = getattr(settings, "IMPORT_REIMPORT_DEDUPE_BATCH_SIZE", 1000)
@@ -399,6 +404,8 @@ def _process_findings_internal(
                         candidates_by_uid,
                         candidates_by_key,
                     )
+                    if finding:
+                        new_findings_in_batch.append(finding)
 
                 # This condition __appears__ to always be true, but am afraid to remove it
                 if finding:
@@ -437,10 +444,14 @@ def _process_findings_internal(
                         findings_with_parser_tags.clear()
                         # Apply import-time tags before post-processing so rules/deduplication see them.
                         self.apply_import_tags_for_batch(batch_findings)
-                        # Apply inherited Product tags to this batch's findings (and
-                        # their endpoints/locations) BEFORE post_process_findings_batch
+                        # Apply inherited Product tags to NEWLY CREATED findings only
+                        # (and their endpoints/locations) BEFORE post_process_findings_batch
                         # dispatches, so rules/dedup see inherited tags on .tags.
-                        apply_inherited_tags_for_findings(batch_findings)
+                        # Matched/existing findings already have inheritance applied from
+                        # their original creation; re-running it on no-change reimports
+                        # would be ~8 wasted queries per batch.
+                        apply_inherited_tags_for_findings(new_findings_in_batch)
+                        new_findings_in_batch.clear()
                         batch_findings.clear()
                         finding_ids_batch = list(batch_finding_ids)
                         batch_finding_ids.clear()

dojo/importers/location_manager.py

@@ -210,11 +210,18 @@ def _persist_locations(self) -> None:
                 all_product_refs, batch_size=1000, ignore_conflicts=True,
             )
 
-        # Trigger bulk tag inheritance
-        tag_inheritance.apply_inherited_tags_for_locations(
-            [loc.location for loc in saved],
-            product=self._product,
-        )
+        # Trigger bulk tag inheritance only when the Location's product
+        # membership actually changed. New product refs are the only thing
+        # that can add a Product to a Location's inherited-tags target set
+        # (new finding refs are always to findings in `self._product`, so
+        # they don't introduce a new Product); skipping when `all_product_refs`
+        # is empty avoids the through-table read on no-change reimports.
+        if all_product_refs:
+            new_ref_location_ids = {ref.location_id for ref in all_product_refs}
+            tag_inheritance.apply_inherited_tags_for_locations(
+                [loc.location for loc in saved if loc.location_id in new_ref_location_ids],
+                product=self._product,
+            )
 
         # Clear accumulators
         self._locations_by_finding.clear()

unittests/test_tag_inheritance_perf.py

@@ -546,5 +546,5 @@ def test_baseline_zap_scan_reimport_no_change_v3(self):
     # eliminating the threading bug; full Phase B reductions land in Stage 2.
     EXPECTED_ZAP_IMPORT_V2 = 420
     EXPECTED_ZAP_IMPORT_V3 = 444
-    EXPECTED_ZAP_REIMPORT_NO_CHANGE_V2 = 74
-    EXPECTED_ZAP_REIMPORT_NO_CHANGE_V3 = 100
+    EXPECTED_ZAP_REIMPORT_NO_CHANGE_V2 = 69
+    EXPECTED_ZAP_REIMPORT_NO_CHANGE_V3 = 81