Skip to content

Move policy bot removal into worker

What does this MR do and why?

This change moves the policy bot removal into worker to prevent timeouts. This change makes it in line with how we create projects: https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/services/security/orchestration/assign_service.rb#L110

Fetching only project ids should perform better compared to pulling and instantiating all the projects:

How to set up and validate locally

  1. Create a project
  2. Go to Secure -> Policies, New policy, Scan execution policy
  3. Switch to .yaml mode and use the following YAML:
    type: scan_execution_policy
    name: Test policy
    description: ''
    enabled: true
    rules:
      - type: pipeline
        branches:
          - '*'
    actions:
      - scan: container_scanning
        tags: []
  4. Configure with merge request & merge
  5. Under Members, observe that a policy bot has been created
  6. Go back to Policies, click "Edit policy project" and unlink the policy project by clicking the trash icon & save
  7. Go back to Members, the policy bot should get removed
  8. Repeat the same on group level with a group policy (create one or two projects within the group, the policy bot should get created / deleted in individual projects)
  9. Unlinking the policy on the group level should remove policy bots in all projects

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #427805 (closed)

Merge request reports

Loading