Security Risk Management: Security Policies 18.1 Planning Issue

Previous planning issue: Security Risk Management: Security Policies 18.... (#535420 - closed)

Narrative

In %18.0, our team achieved significant milestones! We successfully delivered the experimental feature &14147 (closed) (Scheduled Pipeline Execution Policies), which allows users more flexibility in managing their pipeline schedules. We clarified next steps to implement new audit events for policies (&15869 (closed)) and worked on a proof of concept for centralized management of security policies (&17392 (closed)), giving us a better understanding of the impact on GitLab instances.

For %18.1, our primary focus will be on:

  • concluding and releasing &15869 (closed) (Security policy audit events)
  • releasing &16430 (closed) (Optional control of variables) after receiving feedback from Verify team
  • starting frontend work for &11919 (closed) (Flexible Scan Execution Policy Trigger Condition)
  • continuing backend work for &14090 (Exceptions/Bypass in MR Approval Policies), reviewing designs, and preparing an implementation plan
  • starting frontend work and backend implementation for &17392 (closed) (Centralized Management) after promising results from the PoC

We do have some dependencies to be aware of - for Variable precedence controls in pipeline execut... (&16430 - closed), we're waiting for feedback from the Verify team. Additionally, both Centralized Security Policy Management (Beta) (&17392 - closed) and Exceptions and Bypasses in Merge Request Approv... (&14090) are dependent on finalized designs before frontend work can proceed. I'd like to ask the team to review designs quickly when they are prepared and ready by @tparker so we can promptly start working on implementation.

Priorities

To release

Variable precedence controls in pipeline execut... (&16430 - closed)

Target release: %18.1

DRI: @mcavoj / @arfedoro Backend backup DRI: @Andyschoenen

In this milestone, we will finalize backend implementation by addressing any remaining feedback and ensure proper connection with the frontend work completed in the previous milestone. Our goal is to release this feature behind a feature flag, enabling selected customers to start testing it. This will allow us to validate that variable controls work as expected in various pipeline scenarios before wider rollout.

Security policy audit events (&15869 - closed)

Target release: %18.1

DRI: @imam_h / @aturinske Backend backup DRI: @sashi_kumar

Based on our successful proof of concept, we will implement the first set of audit events for security policies in this milestone. We aim to deliver a comprehensive solution that provides customers with visibility into policy-related actions. By the end of the milestone, we should have a releasable feature with documentation and testing completed.

To start/continue working on

Centralized Security Policy Management (Beta) (&17392 - closed)

Target release: %18.2 (beta)

DRI: @mcavoj / @aturinske Backend backup DRI: @alan

For this milestone, we will transform our proof of concept into the beginning of a viable implementation. With UX designs now finalized, we'll build the initial frontend components while developing the underlying backend architecture. Our objective is to make significant progress toward a beta release in %18.2, establishing the foundation for centralized security policy management.

Exceptions and Bypasses in Merge Request Approv... (&14090)

Target release: %18.2

DRI: @sashi_kumar / @arfedoro Backend backup DRI: @mc_rocha

Our goal for this milestone is to complete the architectural blueprint and create a solid implementation plan for exceptions/bypass functionality in Merge Request Approval Policies. We'll review designs, identify technical challenges, and establish a clear path forward for implementation in upcoming milestones. By the end of 18.1, we should have a well-defined roadmap for delivering this feature in 18.2.

Scan Execution Policy Templates (&11919 - closed)

Target release: %18.1

DRI: @alan / @aturinske Backend backup DRI: @mc_rocha

With fresh UX designs now available, we will begin frontend implementation for flexible scan execution policy trigger conditions. We aim to build upon our existing backend proof of concept, connecting it with a user-friendly interface that allows customers to configure more sophisticated trigger conditions. Our objective is to have a working implementation ready by the end of the milestone.

To start planning and breakdown

For this milestone, we won't introduce new planning items, but we will begin reviewing implementation plans for MR Approval Policies Warn Mode (&15552) now that designs are ready. This preliminary work will help us prepare for future development while focusing on our current priorities.

Say/Do

Check tasks you believe you can complete by the next milestone. If you identify any risks in delivery, please leave a comment in this planning issue or in the related Epic/Issue to highlight the risk. This will aid us in communicating any potential delays and improve our predictability. Thank you! 🙇

@mcavoj

@alan

@arfedoro

@imam_h

@aturinske

@sashi_kumar

@Andyschoenen

@bauerdominic

@mc_rocha

Extra

Metrics

Release post items

Release post items related to current work in the format Epic | Release post | Milestone.

Epic Release post Milestone
&14147 (closed) Draft: Release post: Scheduled pipeline executi... (gitlab-com/www-gitlab-com!136769) 18.2
&16430 (closed) Release post: Variable precedence controls in p... (gitlab-com/www-gitlab-com!138810 - merged) 18.1
#525509 (closed) Release post: Merge Request Approval Policy Tim... (gitlab-com/www-gitlab-com!139394 - merged) 18.1
Edited by Alexander Turinske