Update match_on_inclusion to match_on_inclusion_license
What does this MR do and why?
This MR is the first MR to update the match_on_inclusion
property on ScanResultPolicy
to match_on_inclusion_license
.
To avoid impacting policies with the match_on_inclusion
property we are:
- Updating the JSON schema to support both attributes
- Updating the processing service to read from both attributes, having fallback on the old name for existing policies
- Renaming the references to use
match_on_inclusion_license
More context on this comment.
Related to: #424513 (closed)
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
match_on_inclusion
policy on the list
match_on_inclusion
policy blocking a MR
match_on_inclusion_license
policy on the list
match_on_inclusion_license
policy blocking a MR
How to set up and validate locally
- Create a new project
- Add a .gitlab-ci.yml file with the content
include:
- template: Security/Dependency-Scanning.gitlab-ci.yml
- Add a new member to the project with developer access
- Go to Secure > Policies
- Click on New policy
- Select scan result policy
- Change to .yaml mode
- Copy the yaml below:
type: scan_result_policy
name: Deny MIT
enabled: true
rules:
- type: license_finding
match_on_inclusion: true
license_types:
- MIT License
license_states:
- newly_detected
branch_type: protected
actions:
- type: require_approval
approvals_required: 1
role_approvers:
- developer
- Click on Configure with a merge request
- Merge the new MR to add the policy
- Go back to Secure > Policies and verify the new policy is visible
- Create a new MR adding a
Gemfile.lock
file with the following content:
GEM
remote: https://rubygems.org/
specs:
rack (3.0.4.1)
PLATFORMS
arm64-darwin-22
DEPENDENCIES
rack
BUNDLED WITH
2.4.22
- Verify the policy blocked the merge
- Go to Secure > Policies
- Edit the policy changing
match_on_inclusion
tomatch_on_inclusion_license
- Click on Configure with a merge request
- Merge the new MR to add the policy
- Go back to Secure > Policies and verify the new policy is visible
- Repeat the steps 12 and 13
Edited by Marcos Rocha