Skip to content

Resolve "Clarify license approval policy conditions and prerequisites"

What does this MR do and why?

It's not entirely clear in the license approval policy documentation that dependency scanning is a prerequisite.

A license approval policy relies on output of a dependency scanning (DS) job to verify the policy's requirements have been met. If a DS job has not been run, the policy has no data with which to verify the policy's requirements, so enforces approval.

This MR will add to the license approval policy documentation that dependency scanning is a prerequisite. The recommended method of doing so is to enforce DS by using a scan execution policy. The scan execution policy's scope should be the same as that of the license approval policy, otherwise DS must be enabled per project.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #413277 (closed)

Edited by Grant Hickman

Merge request reports

Loading