BE: Create approval rules from multiple approvers actions

Why are we doing this work

In the scope of this issue, we want to update the logic of creating approval rules from actions in YAML to create multiple approval rules for each actions in the YAML.

Relevant links

Non-functional requirements

• Documentation:
• Feature flag:
• Performance:
• Testing:

Implementation plan

• Update approvals_required_exceed_approvers in ValidatePolicyService to get approvers count from all actions.

Verification steps

• Create a project with a security policy
• Enable multiple_approval_actions feature flag for the project
• Update the security policy with multiple approver actions:

    actions:
      - type: require_approval
        approvals_required: 1
        role_approvers:
          - maintainer
      - type: require_approval
        approvals_required: 1
        group_approvers_ids:
          - 64024513
      - type: send_bot_message
        enabled: true

• Create an MR in the project and verify that there are 2 approval rules

added gitlab-org#12319 (closed) as parent epic

changed milestone to %17.6

added Category:Security Policy Management Deliverable backend devopsgovern featureaddition groupsecurity policies sectionsec typefeature workflowrefinement labels

changed the description

changed milestone to %Backlog

assigned to @sashi_kumar

mentioned in issue #490097 (closed)

Removed assignee(s) because the issue is in workflowrefinement but the milestone is not set to a release.

Unscheduled issues receive the least priority for refinement. Leaving them unassigned better communicates that they're not being actively worked on.

Bot policy.

unassigned @sashi_kumar

changed milestone to %17.7

mentioned in merge request !171389 (merged)

changed the description

mentioned in epic gitlab-org#12319 (closed)

@sashi_kumar, could you please refine this issue?

Bot policy.

assigned to @sashi_kumar

added devopssecurity risk management label and removed devopssoftware supply chain security label

Setting health status to on track as the milestone has just begun.

Issue participants are welcome to override this by setting the health status to another value.

changed health status to on track

mentioned in issue #504438 (closed)

added workflowin dev label and removed workflowrefinement label

mentioned in merge request gitlab-com/www-gitlab-com!136770 (merged)

Hey @sashi_kumar

Have you already started working on this task?

I am asking, because I wanted to take more backend tasks in order to improve my backend knowledge.

And I was curious if I could take first part of this issue and extract it to a separate issue and implement it:

Update approvals_required_exceed_approvers in ValidatePolicyService to get approvers count from all actions.

Of course, I only want to do it if you are ok with it. If you have already started it or wants to work with it on your own, I will gladly find another backend task.

Thank you

@arfedoro Thanks for asking! There are 2 parts in this issue:

• Create approval rules from actions array
• Update approvals_required_exceed_approvers in ValidatePolicyService to get approvers count from all actions

I've started working on creating the approval rules(Just created !173534 (merged) to add new columns). Feel free to pick the second part Let me know if you need any help on that.

Big thanks for your contribution on backend for this epic! You are doing a great job

Thank you @sashi_kumar

I really appreciate your help during reviews. Your comments are very insightful and help me to learn quicker

I will pick up the second part, thank you

#505808 (closed)

mentioned in merge request !173534 (merged)

marked this issue as related to #505808 (closed)

mentioned in merge request !174058 (closed)

mentioned in merge request !174279 (merged)

mentioned in merge request !174308 (merged)

mentioned in merge request !175162 (merged)

This issue is scheduled for completion in this milestone but is in an early development stage. Changing health status to 'at risk'.

Issue participants are welcome to override this by setting the health status to another value.

changed health status to at risk

added workflowverification label and removed workflowin dev label

changed the description

Verified in production: https://gitlab.com/gitlab-org/security-risk-management/security-policies/team-member-environment/sashis-test-group/multiple-approver-actions/-/merge_requests/1

unassigned @sashi_kumar

This issue is ready to be verified and according to our verification process we need your help with this activity.

@Andyschoenen, would you mind taking a look if this issue can be verified on production and close this issue?

I can confirm this works on production on my test MR: https://gitlab.com/gitlab-org/security-risk-management/security-policies/team-member-environment/andys-test-group/verify-issue-502228/test/-/merge_requests/1. Thanks @sashi_kumar!

assigned to @Andyschoenen

closed

added workflowcomplete label and removed workflowverification label