Adding a new tag for projects with scan policies creates invalid pipelines

Adding a new tag creates invalid pipelines in the project under the following conditions:

  • scan_execution_policy enabled
  • Auto DevOps disabled
  • no .gitlab-ci.yml file

Investigating the error, it seems that ProjectConfig::SecurityPolicyDefault considers that we should trigger a pipeline to enforce the police scans. However, during the configuration merge process, SecurityOrchestrationPolicies::Processor does not find an applicable policy for the given ref. The policy seems to apply only to branches, not to tags.

I believe we should not trigger a pipeline in this case.

Steps to reproduce

  1. Create a new project with a README.md file
  2. Make sure the project does not have a .gitlab-ci.yml and the Auto DevOps is disabled
  3. Update the readme file
  4. Create a new scan execution policy with the content
type: scan_execution_policy
name: se
description: ''
enabled: true
rules:
  - type: pipeline
    branch_type: all
actions:
  - scan: secret_detection
  1. Go Code > Tags
  2. Add a new tag

A pipeline with an invalid yaml will be created.

Implementation Plan