fix(topology): scope alerts to the owning application before creating/updating incidents

[Prabal864]

What

Fixes #6701.

TopologyProcessor._process_tenant builds one tenant-wide services_to_alerts dict (every alert for every service in the tenant), then passes that same, unscoped dict into _create_application_based_incident / _update_application_based_incident for every application in the loop:

self._update_application_based_incident(
    tenant_id, application, incident, services_to_alerts
)
...
self._create_application_based_incident(
    tenant_id, application, services_to_alerts
)

Both of those methods just iterate every key in whatever dict they're handed (see the loop building alerts in _update_application_based_incident), so an application's incident ends up including alerts from every other application's services too - not just its own.

The method already computes services_with_alerts, the list of this application's own services that have alerts, a few lines above - it's just never used to scope what gets passed on.

Fix

Build application_services_to_alerts, restricted to services_with_alerts, and pass that into both incident methods instead of the raw tenant-wide dict.

Testing

Added tests/test_topology_processor.py, mocking every DB-touching collaborator (_get_topology_data, _get_applications_data, _get_application_based_incident, get_last_alerts, convert_db_alerts_to_dto_alerts) so the scoping logic in _process_tenant can be exercised without a live database. Covers both the create-incident and update-incident paths, asserting each application's incident only ever sees its own service's alerts.

Same environment limitation as my previous PRs here: I couldn't run the suite on this Windows sandbox - tests/conftest.py imports pytest_docker and requires live Docker/MySQL fixtures at collection time, regardless of which test is targeted. What I did verify:

• python -m py_compile passes on both changed files.
• black --check and isort --check report no new issues on the changed files.
• Extracted the exact before/after scoping logic into a standalone script (plain dicts/lists standing in for the DB models) and confirmed the old logic leaks a second application's alerts into the first application's incident, while the new logic does not.

A maintainer running this on Linux/macOS should see tests/test_topology_processor.py pass outright.

Checklist

• I have read the Contributing Guide
• If you've added code that should be tested, add tests.
• If you've changed APIs, update the documentation. — not applicable, no API change.
• Ensure the test suite passes.
• Make sure your code lints (black/isort) — for the lines this PR actually touches.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 46.41%. Comparing base (ce302f6) to head (a354bbc).
⚠️ Report is 12 commits behind head on main.

Files with missing lines	Patch %	Lines
keep/topologies/topology_processor.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6734      +/-   ##
==========================================
- Coverage   46.42%   46.41%   -0.01%     
==========================================
  Files         178      178              
  Lines       18694    18698       +4     
==========================================
  Hits         8679     8679              
- Misses      10015    10019       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[shahargl]

this has many implications, not sure we want to do that as part of this fix, why its mandatory?

[Prabal864]

Good catch, that's not related to this fix, removing it.