Govern: Security Policies 17.2 Planning Issue

Previous planning issue: Govern: Security Policies 17.1 Planning Issue (#461021 - closed)

Narrative

During our last milestone, our team continued to deliver great improvements and enhancements to features offered by groupsecurity policies! One example is Merge request approval policies fail open/close... (&13227 - closed) or Support merge request settings override for any... (&13930 - closed). Congratulations! Great work, team!

At the same time, we have started shifting our focus to spend more time on quality, performance, and improvements that we wanted to introduce with Use database read model for merge request appr... (&9971 - closed) and https://gitlab.com/groups/gitlab-org/-/epics/12033+. We continue our work around and we plan to close this refactoring and performance improvements in this milestone.

In the upcoming milestone, our focus will be on releasing Pipeline Execution Policy Type (&13266 - closed), finalizing Manage scheduled scan execution pipeline concur... (&13997 - closed), and implementing quality and performance improvements in the scope of Use database read model for merge request appr... (&9971 - closed). We will also finalize our efforts on the improvements needed for Cells 1.0 in the scope of (size: M to L) Cells - Workflows: Security Poli... (&12709 - closed). These goals are critical for our team to continue great progress!

Additionally, as in every release, we want to continue solving bugs to improve the UX of Security Policy features and ensure they work correctly. Our customers are increasingly interested in using our features, so we must ensure that Scan Execution and Merge Request Approval Policies work as expected.

Spikes

Priorities

To finalize and close

To start/continue working on

🆕 Audit status check response updates (#413535 - closed) - We have development guidelines and can get support from compliance on adding audit events -- I suspect this should be straightforward. If it's more work we could do a spike and plan for 17.3.
Refine Policy Application Limits (&8084) - Start work to characterize performance from &9971 (closed)
Add groups to security policy scope (Iteration 1) (&14149 - closed) - Candidate to start if we have capacity, or plan/breakdown. I think the path here is already clear.

To start planning and breakdown

🆕 Add authentication to merge request external st... (#433035 - closed)
🆕 Improve compatibility between security policies... (&14119) - To avoid solving for each edge case, we'd like to brainstorm and nail down a proposal for simplifying MR approval policies.
Hide the Security Policy Project and Automate P... (&5446 - closed) - With the recent walkthrough and breakdown of iterations, let's refine and define the implementation plan. We could continue still with Cancelled: Allow Users to View Policy History i... (&5448) if it works as an iteration, or it may make sense to skip forward and add the policy history directly with Iteration 4 instead. We should have problem validation research completed on this soon as well.

typefeature / typemaintenance backend focus

typefeature / typemaintenance frontend focus

typebug backend focus

typebug frontend focus

Extra

Kanban Board with additional smaller maintenance issues and bugs. (Prioritized from top to bottom)
Group Priorities List

Metrics

Engineering Metrics

Release post items

Release post items related to current work in format Epic | Release post | Milestone.

Edited Jun 18, 2024 by Grant Hickman