Skip to content

Trigger auto merge check when the security scans are changed

What does this MR do and why?

When the violations are updated, we should recheck the auto merge process

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

  1. Turn on feature flag policy_mergability_check and ensure you have a Docker runner

  2. In the project, ensure that main is a protected branch.

  3. Create .gitlab-ci.yml:

    include:
      - template: Jobs/Secret-Detection.gitlab-ci.yml
    
    test-job:
      stage: test
      script:
        - echo "Testing"
  4. Go to Secure -> Policies -> New policy. Select "Merge request approval policy".

  5. Switch to the .yaml mode and use the following YAML:

    type: approval_policy
    name: Security
    description: ''
    enabled: true
    rules:
      - type: scan_finding
        scanners: []
        vulnerabilities_allowed: 0
        severity_levels: []
        vulnerability_states: []
        branch_type: protected
    actions:
      - type: require_approval
        approvals_required: 1
        role_approvers:
          - developer
    approval_settings:
      block_branch_modification: true
      prevent_pushing_and_force_pushing: true
      prevent_approval_by_author: true
      prevent_approval_by_commit_author: true
      remove_approvals_with_new_commit: true
      require_password_to_approve: false
    fallback_behavior:
      fail: closed
    
  6. Put a sleep in ee/app/services/security/security_orchestration_policies/update_violations_service.rb :43 sleep(20)

  7. Configure with a merge request && merge

  8. Go back to the project and open a new MR

  9. Create a .env file with `AWS_TOKEN=AKIAZYONPI3G4JNCCWGQ'

  10. Push, and wait for the CI to run, and the mergeability check should fail

  11. Fix the violation by removing the token and push

  12. Set Auto merge while polices are syncing

  13. The MR should auto merge after syncing the polices

Related to #500015

Edited by Marc Shaw

Merge request reports

Loading