Resolve "Introduce merge check for merge request approval policy evaluation"
requested to merge 444459-introduce-merge-check-for-merge-request-approval-policy-evaluation into master
What does this MR do and why?
After !158203 (merged) is merged, we now track the state of the scan status. We can use this state to determine if the scan results are evaluated or not.
We create a new mergeability check to enforce that the scan results are evaluated before merging.
How to set up and validate locally
-
Create a project
-
In the project, ensure that
main
is a protected branch. -
Create
.gitlab-ci.yml
:include: - template: Jobs/Secret-Detection.gitlab-ci.yml test-job: stage: test script: - echo "Testing"
-
Go to Secure -> Policies -> New policy. Select "Merge request approval policy".
-
Switch to the
.yaml mode
and use the following YAML:type: approval_policy name: Security description: '' enabled: true rules: - type: scan_finding scanners: [] vulnerabilities_allowed: 0 severity_levels: [] vulnerability_states: [] branch_type: protected actions: - type: require_approval approvals_required: 1 role_approvers: - developer approval_settings: block_branch_modification: true prevent_pushing_and_force_pushing: true prevent_approval_by_author: true prevent_approval_by_commit_author: true remove_approvals_with_new_commit: true require_password_to_approve: false fallback_behavior: fail: closed
-
Configure with a merge request && merge
-
Go back to the project and open a new MR
-
There should be a
secret_detection
job running and an approval rule "Security" enforced by the policy.
Related to #444459 (closed)
Edited by Marc Shaw