feat(goldfish): mv comparison_status to db, add stats endpoint

[trevorwhitney]

What this PR does / why we need it:

• moves comparison status to the DB so it can be filtered on at query time rather than strictly in the frontend
• add a stats endpoint for overview statistics (ie. engine coverage, matching queries, etc)
• adds indexes to make statistics queries faster (will help the dashboard as well)

Checklist

• Reviewed the CONTRIBUTING.md guide (required)
• Documentation added
• Tests updated
• Title matches the required conventional commits format, see here
  • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
• Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
• If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR

[ghost]

Semgrep identified an issue in your code:
String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by string-formatted-query.

We're currently testing semgrep's diff-aware PR comment feature on a subset of our repos-- if you run into issues or find this spammy, please reach out to @danny.cooper in slack and give feedback.

For backwards compatability with gosec, its best to use polyglot suppression comments of the following format for false positives:
// #nosec <gosec rule ID> nosemgrep: <semgrep rule ID>

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[trevorwhitney]

/fp the query is built with parameterized inputs (?) which is safe

[ghost]

Status updated to ignored - false positive by @trevorwhitney.

_{Reply with /open to re-open this finding}

[ghost]

Semgrep identified an issue in your code:
String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by string-formatted-query.

We're currently testing semgrep's diff-aware PR comment feature on a subset of our repos-- if you run into issues or find this spammy, please reach out to @danny.cooper in slack and give feedback.

For backwards compatability with gosec, its best to use polyglot suppression comments of the following format for false positives:
// #nosec <gosec rule ID> nosemgrep: <semgrep rule ID>

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[trevorwhitney]

/fp the query is built with parameterized inputs (?) which is safe

[ghost]

Status updated to ignored - false positive by @trevorwhitney.

_{Reply with /open to re-open this finding}

[ghost]

Semgrep identified an issue in your code:
String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by string-formatted-query.

We're currently testing semgrep's diff-aware PR comment feature on a subset of our repos-- if you run into issues or find this spammy, please reach out to @danny.cooper in slack and give feedback.

For backwards compatability with gosec, its best to use polyglot suppression comments of the following format for false positives:
// #nosec <gosec rule ID> nosemgrep: <semgrep rule ID>

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[trevorwhitney]

/fp the query is built with parameterized inputs (?) which is safe

[ghost]

Status updated to ignored - false positive by @trevorwhitney.

_{Reply with /open to re-open this finding}

[ghost]

Semgrep identified an issue in your code:
String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by string-formatted-query.

We're currently testing semgrep's diff-aware PR comment feature on a subset of our repos-- if you run into issues or find this spammy, please reach out to @danny.cooper in slack and give feedback.

For backwards compatability with gosec, its best to use polyglot suppression comments of the following format for false positives:
// #nosec <gosec rule ID> nosemgrep: <semgrep rule ID>

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[trevorwhitney]

/fp the query is built with parameterized inputs (?) which is safe

[ghost]

Status updated to ignored - false positive by @trevorwhitney.

_{Reply with /open to re-open this finding}

[Copilot]

Pull Request Overview

This PR adds a new statistics API endpoint to the goldfish feature and refactors filtering to use comparison status from the database. The changes enable aggregated query statistics (execution count, engine coverage, matching queries, and performance metrics) and improve query filtering by precomputing comparison status at storage time.

Key changes:

• Added /api/v1/goldfish/stats endpoint to retrieve aggregated statistics with filtering support
• Introduced comparison_status database column with migration and index for efficient filtering
• Refactored time parameter parsing and validation into reusable helper functions

Reviewed Changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/ui/handler.go	Added stats endpoint handler, trace context middleware, and time parsing helper
pkg/ui/goldfish.go	Added GetStatistics method and extracted validation helpers
pkg/ui/goldfish_test.go	Added comprehensive tests for stats endpoint and updated test helpers
pkg/goldfish/storage_mysql.go	Implemented GetStatistics with aggregate queries and comparison status computation
pkg/goldfish/storage.go	Added GetStatistics method to Storage interface
pkg/goldfish/types.go	Added Statistics, StatsFilter types and ComparisonStatus enum validation
pkg/goldfish/storage_noop.go	Added noop implementation for GetStatistics
pkg/goldfish/migrations/*.sql	Added database migrations for comparison_status column and stats indexes
tools/querytee/*.go	Updated mock implementations with GetStatistics method
tools/querytee/goldfish/goldfish.go	Added package documentation
pkg/goldfish/goldfish.go	Added package documentation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Package comment line 4 ends with 'provide' instead of 'provides' - the comment should read 'This package provides the data structures'.