Introduce S&C Config Page for non Ultimate Users
What does this MR do?
This MR solves #294040 (closed) and #294050 (closed).
It introduces a new static Security and Compliance Static Page which allows to configure SAST via Merge Request for non ultimate Users on CE.
How to reproduce:
- activate the feature flag (
rails c
Feature.enable(:secure_security_and_compliance_configuration_page_on_ce)
) - go to any Project you have at least Developer Access in, which is on any license except Ultimate (any project when running FOSS (
export FOSS_ONLY=1
inenv.runit
in gitlab-development-kit) would also work) - click the Security & Compliance Link in the Sidebar
Note: this feature is currently hidden behind the secure_security_and_compliance_configuration_page_on_ce
Feature Flag.
It got introduced and is managed by the corresponding Backend MR
Screenshots (strongly suggested)
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry - [-] Documentation (if required)
- [-] Code review guidelines
- [-] Merge request performance guidelines
- [-] Style guides
- [-] Database guides
- [-] Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec
-
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team
Related to #294040 (closed)
Edited by Mark Florian