Skip to content

Misleading 100 project limit when applying security policies via compliance framework labels

Summary

In the group-level security policy list view, pipeline execution policies scoped to projects using a compliance framework label display the following text in the "Scope" column:

100 projects which have compliance framework...

This text is misleading as it suggests that only 100 projects will have the policy applied, even if there are more projects with the framework label (potentially thousands).

Note that this bug is purely cosmetic, as the policy is correctly applied to all intended projects.

Steps to Reproduce

  1. Create a compliance framework.
  2. Apply a compliance framework to more than 100 projects in a group.
  3. Create a pipeline execution policy scoped to projects using this compliance framework label.
  4. View the group-level security policy list, it will state that the policy applies to 100 projects with the compliance framework.

Current Behavior

The "Scope" column shows a fixed number of 100 projects, regardless of the actual number of projects with the compliance framework label.

Expected Behavior

The "Scope" column should accurately reflect the total number of projects that have the compliance framework label applied, or use more appropriate wording that doesn't imply a limit.

Proposed Solution

Add pagination logic to fetch the correct number of projects when populating the "Scope" column. This will ensure that the displayed information accurately represents the total number of projects affected by the policy.

Output of checks

This bug happens on GitLab.com

Edited by Alejandro Guerrero