Skip to content

Disallow negative integers for vulnerabilities_allowed

What does this MR do and why?

This MR is a follow-up of !118919 (comment 1377802248) and updates the security orchestration schema to not allow negative integers for vulnerabilities_allowed.

Screenshots or screen recordings

CleanShot_2023-05-04_at_10.03.50_2x

CleanShot_2023-05-04_at_10.04.08_2x

How to set up and validate locally

  1. Navigate to a project/group => Security & Compliance => Policies => New policy => Scan result policy
  2. Add a security scan
  3. Switch to .yaml editor and change vulnerabilities_allowed to -1 (or any other negative numbers)
  4. Observe the warning in the .yaml editor
  5. Click on "Configure with a merge request"
  6. Observe an error "Invalid policy YAML"

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #396992 (closed)

Merge request reports

Loading