Skip to content

Security Risk Management: Security Policies 17.11 Planning Issue

Previous planning issue: Security Risk Management: Security Policies 17.... (#520024 - closed)

Narrative

In %17.10, our team made significant progress on several key initiatives! We successfully released Compliance handling of `needs` statements in pi... (#469256 - closed) (Compliance handling of needs statements in pipeline execution policies), which was a major milestone for ensuring proper execution order in pipeline execution policies. Great work team! 🎉

We continued our development on Scheduled pipeline execution policies (&14147) (Scheduled pipeline execution policies) with a clear plan to deliver it as an experimental feature to gather early feedback from customers. We made substantial progress on the license approval policies capabilities in the scope of Exclude packages from Merge Request Approval Po... (&10203 - closed) (Exclude packages from Merge Request Approval Policies for License Approval Rules).

Additionally, we began exploring two important new areas: Variable precedence controls in pipeline execut... (&16430 - closed) (Optional control of variables when pipeline execution policies are enforced) and Validate, accompany with enabling `policy_merga... (#504700 - closed) (Validate and address identified problems with policy_mergability_check). These initiatives will give our users more control and flexibility with their security policy workflows.

For %17.11, our focus will be on the following key tasks:

As always, we're working hard to fix bugs and improve our Security Policy features. We're seeing more and more customers using these features, which means we need to ensure they work reliably at scale. Let's continue to collaborate and deliver high-quality improvements that meet our users' needs!

Priorities

To release

Exclude packages from Merge Request Approval Po... (&10203 - closed)

Target release: %17.11

DRI: @mc_rocha / @arfedoro

In %17.10, we made excellent progress on both frontend and backend implementations for this feature. In %17.11, we want to finalize the remaining backend tasks, thoroughly test the feature in multiple scenarios, and enable the required feature flags on GitLab.com to release this capability to our users.

To start/continue working on

Scheduled pipeline execution policies (&14147)

Target release: %18.0

DRI: @Andyschoenen / @aturinske

In %17.10, we made significant progress on both frontend and backend implementations. For %17.11, we want to focus on adding safeguards and documentation changes needed to help customers enable this as an experiment. This approach will allow us to gather valuable feedback while ensuring a smooth experience for early adopters.

Variable precedence controls in pipeline execut... (&16430 - closed)

Target release: %18.1

DRI: @mcavoj / @arfedoro

We want to continue the spike development we started in %17.10 (Spike: Investigate Optional Control of Variable... (#520088 - closed)), clarify approaches with the Verify team, and deliver a proof of concept. Simultaneously, we'll collaborate on UX design for this feature to prepare for full development in the next milestone.

Explore pipeline execution policy limits for cu... (&16929 - closed)

Target release: TBD

DRI: @bauerdominic (@alan during Dominic's PTO)

In %17.11, we want to start working on adding a setting to configure limits related to pipeline execution policies. This will help address scalability concerns for customers with large-scale deployments using a single top-level group.

To investigate

We want to continue our investigation of several important areas to ensure we're building a solid foundation for future improvements:

@arfedoro

@mc_rocha

@Andyschoenen

@imam_h

@aturinske

@bauerdominic

@alan

@mcavoj

@sashi_kumar

Extra

Metrics

Release post items

Release post items related to current work in the format Epic | Release post | Milestone.

Epic Release post Milestone
Edited by Artur Fedorov