Skip to content

Govern: Security Policies 17.6 Planning Issue

Previous planning issue: Govern: Security Policies 17.5 Planning Issue (#488661 - closed)

Narrative

In %17.5, our team was working on finalizing work related to Use database read model for merge request appr... (&9971 - closed) and Manage scheduled scan execution pipeline concur... (&13997 - closed), improvements to the Pipeline Execution Policies (Compliance handling of `needs` statements in pi... (#469256 - closed), Scheduled pipeline execution policies (&14147), and Enforce Custom Stages in Pipeline Execution Pol... (#475152 - closed)) and work related to Improve compatibility between security policies... (&14119) and Support multiple distinct approval actions in m... (&12319 - closed). We made some progress in many of these deliverables. However, we need to continue our work to deliver it in this and the next milestone.

For the upcoming milestone, our focus will be on the following key tasks:

At the same time, we need to prepare for implementation issues related to work planned for future milestones:

In every release, we aim to address bugs and fine-tune Security Policy features for an improved user experience. With customers' growing interest in utilizing these features, it is vital that Scan Execution and Merge Request Approval Policies function effectively to ensure we can scale and meet customer demands. Let's work together to achieve this!

Priorities

To release

To finalize and close

Use database read model for merge request appr... (&9971 - closed)

DRI: @sashi_kumar

In %17.6, we want to finally close the work related to read-model epic and ensure it is working as expected and not causing an impact on infrastructure. We will leave the feature flag for the following 2-3 milestones to observe this feature's impact on our overall performance and in %18.0 we will schedule additional cleanup.

Manage scheduled scan execution pipeline concur... (&13997 - closed)

DRI: @mc_rocha (looking for volunteer as Marcos is OOO currently) / @aturinske

In %17.5 we have merged all related MRs. However, we still need to enable FFs to deliver the first iteration. In %"17.6," we want to provide documentation changes and slightly modify the proposed solution to use concurrency limit bound with the top-level group and enable related feature flags.

Compliance handling of `needs` statements in pi... (#469256 - closed)

Target release: %17.6

DRI: @Andyschoenen

In %17.6, we want to continue the work from the last milestone and deliver the changes needed to ensure that jobs enforced by Pipeline Execution Policies are running in proper order, preventing users from running jobs before the reserved stage when an empty needs: statement is used. Our goal is to deliver it in %17.6.

To start/continue working on

Scheduled pipeline execution policies (&14147)

Target release: %17.9

DRI: @Andyschoenen / @aturinske

In %17.5, we continued our work on PoC (Add pipeline execution policy schedule run (!162554 - closed)), we agreed on policy schema and planned limitation. In %17.6, we need to deliver PoC behind the feature flag to allow to validate this feature with testers and selected customers.

Enforce Custom Stages in Pipeline Execution Pol... (#475152 - closed)

Target release: %17.7

DRI: @mcavoj

Thanks to suggestions from @mcavoj and feedback received from customers we have decided to start working on this Epic earlier than we initially wanted. Due to other deliverables, in %17.5 we have not started working on it yet. Starting discussions around this feature is crucial (especially with devopsverify team) to successful delivery, so we need to start doing it early.

Improve compatibility between security policies... (&14119)

DRI: @mcavoj

Target release: --- After the discussion with @g.hickman, this does not have a target milestone, we will be doing multiple smaller experiments to see how this is helpful for customers.

In %17.6, we want to continue delivery of two items we started in %17.5: first, providing changes to improve alignment between Merge Request Approval Policies and Scan Execution Policies, not to require approval when scan results are missing, but the scan was enforced with active Scan Execution Policy. Additionally, we want to investigate how we could improve compatibility between analyzers and policies by introducing a mechanism to communicate in the scope of Spike: Store analyzers results metadata to allo... (#471978 - closed). After this, we will decide with @g.hickman what our next steps would be. This Epic requires engineers creativity and will consist of smaller items that we will be improving every milestone. As it is unclear how we want to achieve it, we will strive to enhance how policies are evaluated to help with adoption of this feature.

Support multiple distinct approval actions in m... (&12319 - closed)

DRI: @sashi_kumar / @arfedoro

Target release: %17.7

We already started working on this in the last milestone, with great additions from the backend side prepared by @arfedoro. We want to continue this work and start delivering both the backend and frontend to test it first.

To start planning and breakdown

Say/Do

Please check tasks that you are confident you will be able to deliver within next milestone. When you see a risk in delivering something, please write a comment in this planning issue or in the related Epic/Issue raising the risk. We will be using this to help us better communicate when something might slip and to help us with our predictability. Thanks! 🙇

@arfedoro

Delivered extra:

  1. Prevent decomposeApprovers from adding empty ap... (#504056 - closed) • Artur Fedorov • 17.6
  2. Remove legacy scan_result_approvers from securi... (#503425 - closed) • Artur Fedorov • 17.7
  3. Replace scanResultPolicyApprovers with actionAp... (#503410 - closed) • Artur Fedorov • 17.7
  4. Remove stepper in policy editor (#502205 - closed) • Artur Fedorov • 17.6
  5. Misleading 100 project limit when applying secu... (#501456 - closed) • Artur Fedorov • 17.6

@sashi_kumar

@alan

@aturinske

@mc_rocha

@mcavoj

@Andyschoenen

Extra

Metrics

Release post items

Release post items related to current work in the format Epic | Release post | Milestone.

Epic Release post Milestone
&13997 (closed) Draft: Release post: Manage scheduled scan exec... (gitlab-com/www-gitlab-com!135173 - merged) %17.6
&13776 (closed) Release post: Prevent branch modification of gr... (gitlab-com/www-gitlab-com!135580 - merged) %17.6
#469256 (closed) Release post: Compliance handling of `needs` st... (gitlab-com/www-gitlab-com!136768 - merged) %17.6
Edited by Artur Fedorov