Allow `ScanExecutionPolicyResolver` to resolve group-level policies

Why are we doing this work

As part of the implementation for Group-level security policies (&4425 (closed)), we need to update ScanExecutionPolicyResolver to be able to return group-level security policies.

Relevant links

Non-functional requirements

  • Documentation:
  • Feature flag:
  • Performance:
  • Testing:

Implementation plan

  1. Add a new scope to OrchestrationPolicyConfiguration which will query all the policy configurations by namespace.self_and_ancestors.
  2. Create a new PolicyFinder which will query all of the policy configurations, get all of their policies, and then merge them together.
  3. Add a new relationship parameter to the scanExecutionPolicies graphql query which can have the values DIRECT or INHERITED. DIRECT will be the default and will return policies belonging to the project only (current behavior). INHERITED will return the project's policies as well as the ancestor's policies. (This prevents breaking changes to facilitate Zero-downtime upgrades.)