Skip to content

Resolve "Introduce merge check for merge request approval policy evaluation"

What does this MR do and why?

After !158203 (merged) is merged, we now track the state of the scan status. We can use this state to determine if the scan results are evaluated or not.

We create a new mergeability check to enforce that the scan results are evaluated before merging.

How to set up and validate locally

  1. Create a project

  2. In the project, ensure that main is a protected branch.

  3. Create .gitlab-ci.yml:

    include:
      - template: Jobs/Secret-Detection.gitlab-ci.yml
    
    test-job:
      stage: test
      script:
        - echo "Testing"
  4. Go to Secure -> Policies -> New policy. Select "Merge request approval policy".

  5. Switch to the .yaml mode and use the following YAML:

    type: approval_policy
    name: Security
    description: ''
    enabled: true
    rules:
      - type: scan_finding
        scanners: []
        vulnerabilities_allowed: 0
        severity_levels: []
        vulnerability_states: []
        branch_type: protected
    actions:
      - type: require_approval
        approvals_required: 1
        role_approvers:
          - developer
    approval_settings:
      block_branch_modification: true
      prevent_pushing_and_force_pushing: true
      prevent_approval_by_author: true
      prevent_approval_by_commit_author: true
      remove_approvals_with_new_commit: true
      require_password_to_approve: false
    fallback_behavior:
      fail: closed
    
  6. Configure with a merge request && merge

  7. Go back to the project and open a new MR

  8. There should be a secret_detection job running and an approval rule "Security" enforced by the policy.

Related to #444459 (closed)

Edited by Marc Shaw

Merge request reports

Loading