Skip to content

Include comparison pipelines for error cases

Description

Bot comments for security scan and license findings include comparison pipelines today, but if there is only an error, such as a mismatch in scanners on source and target branches, we do not display which pipelines are being considered.

This makes it challenging for users to troubleshoot which pipelines may be affecting the results.

How to set up and validate locally

  1. Create a new project
  2. Add a .gitlab-ci.yml with the content
build1:
  stage: build
  script:
    - echo "Do your build here"
  1. Go to Secure > Policies
  2. Click in New policy
  3. Select Merge request approval policy
  4. change to the yaml mode
  5. Copy the yaml content below:
type: approval_policy
name: a
description: ''
enabled: true
rules:
  - type: scan_finding
    scanners:
      - secret_detection
    vulnerabilities_allowed: 0
    severity_levels: []
    vulnerability_states: []
    branch_type: protected
actions:
  - type: require_approval
    approvals_required: 1
    role_approvers:
      - developer
      - maintainer
  - type: send_bot_message
    enabled: true
approval_settings:
  block_branch_modification: true
  prevent_pushing_and_force_pushing: true
  prevent_approval_by_author: false
  prevent_approval_by_commit_author: false
  remove_approvals_with_new_commit: false
  require_password_to_approve: false
fallback_behavior:
  fail: closed
  1. Click in Configure with a merge request
  2. Merge the the MR
  3. Go back to the project created on step 1
  4. Create a new MR editing the README file
  5. Verify the bot comment about the missing scan contains the Comparison pipelines information
Edited by Marcos Rocha