Skip to content

SPIKE: Update yaml in policy drawer/editor to match policy file

Why are we doing this work

From #478628 (comment 2129860855)

Current state - policy.yml Current state - policy editor Proposal - policy editor 
---
scan_execution_policy:
- name: SAST Enforcement
  description: ''
  description: test
  enabled: true
  policy_scope:
    compliance_frameworks:
    - id: 1016735
    - id: 1016733
    - id: 1016734
  rules:
  - type: pipeline
    branch_type: protected
  actions:
  - scan: sast
    template: latest
## other scan execution policies may be in the array
 
type: scan_execution_policy
name: SAST Enforcement
description: ''
enabled: true
policy_scope:
  compliance_frameworks:
    - id: 1016735
    - id: 1016733
    - id: 1016734
rules:
  - type: pipeline
    branch_type: protected
actions:
  - scan: sast
    template: latest
 
scan_execution_policy:
- name: SAST Enforcement
  description: ''
  description: test
  enabled: true
  policy_scope:
   compliance_frameworks:
    - id: 1016735
    - id: 1016733
    - id: 1016734
  rules:
  - type: pipeline
    branch_type: protected
  actions:
  - scan: sast
    template: latest

Key points:

  1. This would allow users to see how the policy.yml rule would appear directly, with all indentation matching.
  2. I considered for a while what to do for type. I can see how you can't directly copy/paste, but I think it makes more sense to show a fully functioning policy.yml that would work in isolation. Then we can share context that scan_execution_policy is a type and all related policies in the file must be added in the array. 🤔
  3. I'm okay if we just remove type as you suggested, in which case we can add context somehow that the policy rule would need to be applied in the type array.
  4. Long-term, I think this could make it simpler for all policies when we end up with more policy types. I still see it as a preview and it will be limited, but better if portions of it are accurate to the code itself in my view (indentation included) 🤔

Relevant links

Non-functional requirements

  • Documentation:
  • Feature flag:
  • Performance:
  • Testing:

Implementation plan

  • frontend update the default yaml to be in the new format
  • frontend update the incoming existing yaml to be in the new formate
  • frontend update the policy <=> yaml methods to make it so none of the rule mode methods need to be updated to change the policy (e.g. the policy object is as it is now and is only converted to the new yaml format)
  • frontend update the policy schema validation to validate the yaml properly

Verification steps

  1. Upload a GitLab Ultimate license
  2. Navigate to a project/group => Secure => Policies => New policy => Select any policy type
  3. Verify the yaml preview shows the new format
  4. Make some changes in rule mode
  5. Verify the yaml preview updates accordingly
  6. Navigate to yaml mode
  7. Verify the yaml validation is working
  8. Make some changes in yaml mode => Navigate back to rule mode
  9. Verify the rule mode has updated properly
  10. Save the policy => Navigate back to the project/group => Secure => Policies => Select the new policy
  11. Verify the drawer renders correctly
Edited by Alexander Turinske