Fix license approval policy for pre-existing license_state
What does this MR do and why?
This MR addresses 2 items:
- Fixes MR approval policies (
license_finding
type) to enforce approval correctly for pre-existing license states (#442045 (closed)) - Add's comparison pipelines information to policy violation bot comment for
license_finding
rules - Refactors
Security::SyncLicenseScanningRulesService
to break into granular classes (#454415 (closed)):Security::ScanResultPolicies::UpdateLicenseApprovalsService
Security::ScanResultPolicies::LicenseViolationChecker
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Bot comment for previously existing states
Bot comment for newly introduced states
How to set up and validate locally
- Make sure to sync licenses and package metadata by following : https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/howto/license_compliance.md
- Create a project and add dependency scanning to gitlab-ci.yml
include:
- template: Jobs/Dependency-Scanning.gitlab-ci.yml
build-job:
script:
- echo "Building"
- Add a Gemfile.lock with some dependencies (MIT license)
GEM
remote: https://rubygems.org/
specs:
diff-lcs (1.5.1)
rspec (3.13.0)
rspec-core (~> 3.13.0)
rspec-expectations (~> 3.13.0)
rspec-mocks (~> 3.13.0)
rspec-core (3.13.0)
rspec-support (~> 3.13.0)
rspec-expectations (3.13.0)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.13.0)
rspec-mocks (3.13.0)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.13.0)
rspec-support (3.13.1)
PLATFORMS
arm64-darwin-21
DEPENDENCIES
rspec (~> 3.13)
BUNDLED WITH
2.4.13
- Go to Secure -> Policies and create a new policy:
type: approval_policy
name: Pre-Existing License Policy
description: ''
enabled: true
rules:
- type: license_finding
match_on_inclusion_license: true
license_types:
- MIT License
license_states:
- detected
branch_type: protected
actions:
- type: require_approval
approvals_required: 1
role_approvers:
- developer
- Create an MR that updates README and verify that the MR requires approval and bot comment is added
Addresses #442045 (closed)
Edited by Sashi Kumar Kumaresan