Skip to content

Security Risk Management: Security Policies 17.7 Planning Issue

Previous planning issue: Govern: Security Policies 17.6 Planning Issue (#499231 - closed)

Narrative

In %17.6, our team focused on completing tasks associated with &9971 (closed) and &13997 (closed), enhancing the Pipeline Execution Policies (#469256 (closed), &14147, and #475152 (closed)), as well as working tied to &14119 and &12319 (closed). We made progress on several of these deliverables. Most importantly, we finalized and released the following: &13997 (closed) and &13776 (closed)! Great work team! 🎉

Regarding the other planned items, some demanded more effort than we initially expected, particularly the work concerning Pipeline Execution Policies, which involves collaboration with the Verify team. Nevertheless, we must continue our efforts to accomplish this in both the current milestone.

For the upcoming milestone, our focus will be on the following key tasks:

We also need to start working on implementation issues related to work planned for future milestones:

In each release, we strive to fix bugs and refine the Security Policy features to enhance user experience. As customer interest in these features increases, it becomes crucial for the Scan Execution and Merge Request Approval Policies to operate effectively, allowing us to scale and meet the demands of our customers. Let's collaborate to make this happen!

Priorities

To release

To finalize and close

Use database read model for merge request appr... (&9971 - closed)

Target release: %17.7

DRI: @sashi_kumar

In %17.6, we came very close to finalizing it. However, %17.7 is where we aim to complete the work related to the read-model epic, ensuring it functions as intended without affecting the infrastructure. We will retain the feature flag for the next 2-3 milestones to monitor its impact on overall performance, and in %18.0, we will plan for further cleanup.

Compliance handling of `needs` statements in pi... (#469256 - closed)

Target release: %17.7

DRI: @Andyschoenen

In %"17.6," we have released the needed changes, although we could not start enabling the feature flag. In %17.7, we want to carefully enable it and verify customers' use cases to ensure this change will not break their workflows and enable it by default, leaving the feature flag for some time to observe the impact.

To start/continue working on

Scheduled pipeline execution policies (&14147)

Target release: %17.9

DRI: @Andyschoenen / @aturinske

In %"17.6," we continued working on the PoC (Add pipeline execution policy schedule run (!162554 - closed)); our goal was to deliver it behind the feature flag to selected users. However, during the review with the Verify team, we decided to have a different outcome for this PoC: a clear implementation plan for how this feature should address all identified problems. In %17.7, we want to start that.

Enforce Custom Stages in Pipeline Execution Pol... (#475152 - closed)

Target release: %17.7

DRI: @mcavoj

We had a great start, with changes prepared early in the previous milestone. However, after a thorough discussion with Verify, we have decided to solve the identified bugs first before delivering this improvement and to validate if we need it with customers.

Improve compatibility between security policies... (&14119)

DRI: @mcavoj

Target release: --- After the discussion with @g.hickman, this does not have a target milestone, we will be doing multiple smaller experiments to see how this is helpful for customers.

In %17.6, we want to continue delivery of two items we started in %17.5: first, providing changes to improve alignment between Merge Request Approval Policies and Scan Execution Policies, not to require approval when scan results are missing, but the scan was enforced with active Scan Execution Policy. Additionally, we want to investigate how we could improve compatibility between analyzers and policies by introducing a mechanism to communicate in the scope of Spike: Store analyzers results metadata to allo... (#471978 - closed). After this, we will decide with @g.hickman what our next steps would be. This Epic requires engineers creativity and will consist of smaller items that we will be improving every milestone. As it is unclear how we want to achieve it, we will strive to enhance how policies are evaluated to help with adoption of this feature.

Support multiple distinct approval actions in m... (&12319 - closed)

DRI: @sashi_kumar / @arfedoro

Target release: %17.7

We continued amazing work, on both frontend and backend initiated by @arfedoro. In this milestone, we will focus fully on the backend and release the feature for customers.

MR Approval Policies Warn Mode (&15552)

DRI: @aturinske / @alan

Target release: %17.7

In the last milestone, we have been discussing with UX and PM how to solve this problem for customers. Finally, we have a good answer, and we can start working on this initiative that should help customers reduce the amount of work needed to begin using policies. We would like to work in this milestone on delivering this Epic.

Support custom roles in merge request approval ... (&13550 - closed)

DRI: @aturinske / @sashi_kumar

Target release: %17.7

We want to allow users to use Custom Roles as an addition to our list of available Approvers to help them better manage who can approve code in selected MRs. We want to start working on that, with a goal of finalizing it within single milestone.

To start planning and breakdown

Say/Do

Check tasks you believe you can complete by the next milestone. If you identify any risks in delivery, please leave a comment in this planning issue or in the related Epic/Issue to highlight the risk. This will aid us in communicating any potential delays and improve our predictability. Thank you! 🙇

@alan

@aturinske

@arfedoro

@mcavoj

@Andyschoenen

@sashi_kumar

@mc_rocha

Extra

Metrics

Release post items

Release post items related to current work in the format Epic | Release post | Milestone.

Epic Release post Milestone
Manage scheduled scan execution pipeline concur... (&13997 - closed) gitlab-com/www-gitlab-com!137202 (merged) 17.7
Compliance handling of `needs` statements in pi... (#469256 - closed) gitlab-com/www-gitlab-com!136768 (merged) 17.7
Support multiple distinct approval actions in m... (&12319 - closed) gitlab-com/www-gitlab-com!136770 (merged) 17.7
Enforce Custom Stages in Pipeline Execution Pol... (#475152 - closed) gitlab-com/www-gitlab-com!136767 (merged) 17.8
Scheduled pipeline execution policies (&14147) gitlab-com/www-gitlab-com!136769 TBD
Edited by Artur Fedorov