fix(Code References): Code references are slow to query

[emyller]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Important

Contains a data migration.

Closes #5932
Would originally close #6832

Improve code references so they're usable again.

The previous data model did not handle accumulated code references too well, and we had to disable it.

This patch will:

• Complete redesign the data model of code references.
• Migrate old data to new data.
• Make code references viable for GA: in an hypothetical project with 400 features, 200K code references scans, list annotation improved from ~21s to ~12ms (around 1700x increase), and detail query improved from ~77ms to 1.4ms (~55x). Gotta go fast.
• Prevent duplicate scans — for hygiene: performance gain does not rely on this.
• Add a new "vcs_provider" to the API — but defaults to "github" for compatibility. This will allow support other VCS endeavours for free.
• Delete code_references_ui_stats feature flag branches, 🎉.

How did you test this code?

• Unit tests.
• Benchmarking — tested on Apple silicon.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	May 19, 2026 8:24pm
flagsmith-frontend-preview	Ignored	Preview	May 19, 2026 8:24pm
flagsmith-frontend-staging	Ignored	Preview	May 19, 2026 8:24pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.48%. Comparing base (fbb1052) to head (64007c8).
⚠️ Report is 25 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7463      +/-   ##
==========================================
+ Coverage   98.44%   98.48%   +0.03%     
==========================================
  Files        1399     1402       +3     
  Lines       52667    53291     +624     
==========================================
+ Hits        51847    52481     +634     
+ Misses        820      810      -10     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-7463	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-7463	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-7463	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-api:pr-7463	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-7463	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-7463	Finished ✅	Results ✅

[github-actions]

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 37.3 seconds
 2b0f99e
 🔄 Run: #16672 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 44.5 seconds
 2b0f99e
 🔄 Run: #16672 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 18 passed

Details

 18 tests across 14 suites
 1 minute, 10 seconds
 2b0f99e
 🔄 Run: #16672 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 29.7 seconds
 2b0f99e
 🔄 Run: #16672 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 32.1 seconds
 d087401
 🔄 Run: #16673 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 43.1 seconds
 d087401
 🔄 Run: #16673 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 42.1 seconds
 d087401
 🔄 Run: #16673 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 48.9 seconds
 d087401
 🔄 Run: #16673 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 32 seconds
 e9575cd
 🔄 Run: #16674 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 43.1 seconds
 e9575cd
 🔄 Run: #16674 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 41.9 seconds
 e9575cd
 🔄 Run: #16674 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 2 passed

Details

 2 tests across 2 suites
 42.6 seconds
 e9575cd
 🔄 Run: #16674 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 33.2 seconds
 c2016ef
 🔄 Run: #16675 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 46.3 seconds
 c2016ef
 🔄 Run: #16675 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 3 passed

Details

 3 tests across 3 suites
 39.5 seconds
 c2016ef
 🔄 Run: #16675 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 1 failed
 1 passed

Details

 2 tests across 2 suites
 55.4 seconds
 c2016ef
 📦 Artifacts: View test results and HTML report
🔄 Run: #16675 (attempt 1)

Failed tests

firefox › tests/project-permission-test.pw.ts › Project Permission Tests › Project-level permissions control access to features, environments, audit logs, and segments @enterprise

### Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 38.7 seconds
 e9575cd
 🔄 Run: #16676 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 42.7 seconds
 e9575cd
 🔄 Run: #16676 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 31.6 seconds
 e9575cd
 🔄 Run: #16676 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 39.2 seconds
 803642d
 🔄 Run: #16677 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 18 passed

Details

 18 tests across 14 suites
 1 minute, 6 seconds
 803642d
 🔄 Run: #16677 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 42.2 seconds
 803642d
 🔄 Run: #16677 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 2 passed

Details

 2 tests across 2 suites
 31.4 seconds
 803642d
 🔄 Run: #16677 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 38.6 seconds
 29f3276
 🔄 Run: #16766 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 42.8 seconds
 29f3276
 🔄 Run: #16766 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 1 minute, 8 seconds
 29f3276
 🔄 Run: #16766 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 32.8 seconds
 29f3276
 🔄 Run: #16766 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 36.3 seconds
 52e663c
 🔄 Run: #16767 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 43.3 seconds
 52e663c
 🔄 Run: #16767 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 49.6 seconds
 52e663c
 🔄 Run: #16767 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 46.9 seconds
 52e663c
 🔄 Run: #16767 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 31.9 seconds
 b77aae5
 🔄 Run: #16839 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 41.9 seconds
 b77aae5
 🔄 Run: #16839 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 39.6 seconds
 b77aae5
 🔄 Run: #16839 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 46.7 seconds
 b77aae5
 🔄 Run: #16839 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 38.8 seconds
 8781ad4
 🔄 Run: #16840 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 45.8 seconds
 8781ad4
 🔄 Run: #16840 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 38.2 seconds
 8781ad4
 🔄 Run: #16840 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 44.3 seconds
 8781ad4
 🔄 Run: #16840 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 42.8 seconds
 64007c8
 🔄 Run: #16843 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 38.8 seconds
 64007c8
 🔄 Run: #16843 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 36.8 seconds
 64007c8
 🔄 Run: #16843 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 43.6 seconds
 64007c8
 🔄 Run: #16843 (attempt 1)

[github-actions]

Visual Regression

19 screenshots compared. See report for details.
View full report