Security Risk Management: Security Policies 17.10 Planning Issue

Previous planning issue: Security Risk Management: Security Policies 17.... (#512833 - closed)

Narrative

In %17.9, we've been super busy and delivered some great improvements! We wrapped up our work on Pipeline Execution Policies improvements (Enforce Custom Stages in Pipeline Execution Pol... (#475152 - closed)), made good progress on workflow enhancements (Unable to edit or add new policies after projec... (&15083 - closed)), and completed the Custom Roles integration (Support custom roles in merge request approval ... (&13550 - closed)). We also tackled some important improvements (CI_MERGE_REQUEST_SOURCE_BRANCH_SHA does not see... (#512916 - closed)). Great work team! 🎉

For %17.10, we're focusing on some exciting new work. We'll keep pushing forward with our Scheduled Pipeline Execution Policies improvements (Scheduled pipeline execution policies (&14147)) - we're making good progress here and working closely with the Verify team to get things just right. We're also continuing our work on license approval policy capabilities (Exclude packages from Merge Request Approval Po... (&10203 - closed)) and aiming to release Compliance handling of `needs` statements in pi... (#469256 - closed), which will make pipeline execution policies handle job ordering much better.

We're also starting some new and interesting work! We're kicking off development on optional variable control for pipeline execution policies (Variable precedence controls in pipeline execut... (&16430 - closed)) and teaming up with the Code Review team to improve policy mergability checks (Validate, accompany with enabling `policy_merga... (#504700 - closed). These changes will give our users more control over their security workflows while keeping everything secure.

Looking ahead, we've got some important groundwork to lay for the future of Security Policies. We're starting several investigations to make sure we can handle growth and scale well:

As always, we're working hard to fix bugs and improve our Security Policy features. We're seeing more and more customers using these features, which is fantastic! That means we need to make sure our Scan Execution and Merge Request Approval Policies keep working great as usage grows. We're thinking ahead by starting architectural planning now - it might seem early, but it'll help us stay ahead of the curve.

So, let's dive in together! If you have any thoughts or ideas about how we can make these features even better, please share them. Looking forward to seeing what we can achieve in this release!

Priorities

To release

Compliance handling of `needs` statements in pi... (#469256 - closed)

Target release: %17.10

DRI: @Andyschoenen

In %17.9, we have been focused on validating with customers and ensuring that there would be no unwanted side effects. In %17.10, we want to enable this feature flag and validate it works as expected.

To start/continue working on

Scheduled pipeline execution policies (&14147)

Target release: %17.10 (exploring)

DRI: @Andyschoenen / @aturinske

In %17.9, we made significant progress on both frontend and backend. For %17.10, we want to explore the possibility of delivering this functionality behind a feature flag to start testing and validating with selected customers. This approach will help us ensure the feature works as expected before wider rollout.

MR Approval Policies Warn Mode (&15552)

Target release: %17.10

DRI: @aturinske / @alan

We will continue our work with the AppSec team to identify and address any gaps before enabling this feature internally. This collaboration will help us ensure we meet all security requirements as we move towards dogfooding with our AppSec Team.

Exclude packages from Merge Request Approval Po... (&10203 - closed)

Target release: %17.11

DRI: @mc_rocha / @arfedoro

We're focusing on finalizing both the backend and frontend implementation for this feature. Once completed, we'll move into the testing phase to ensure everything works as expected.

Variable precedence controls in pipeline execut... (&16430 - closed)

Target release: TBD

DRI: @mcavoj / @arfedoro

We're initiating investigation through a spike to better understand the requirements and implementation challenges. This feature will require another round of collaboration with the Verify team, which we expect will extend the timeline for release. We want to ensure we have a solid plan before starting the implementation.

To investigate

We want to start exploring several important areas through spikes to ensure we're building a solid foundation for future improvements:

@mcavoj

@arfedoro

@alan

@sashi_kumar

@aturinske

@mc_rocha

@Andyschoenen

@bauerdominic

Extra

Metrics

Release post items

Release post items related to current work in the format Epic | Release post | Milestone.

Epic Release post Milestone
Edited by Alexander Turinske