Update bot comment message for warn mode MRAP settings

Why are we doing this work

  • when a MRAP is in warn mode, it's settings should not be applied
  • users want to see which settings are being ignored due to a policy being in warn mode

Proposal

Current state

Current State (Enforce mode) Proposed (Warn mode)

image.png
  • When a policy in warn mode is applied, make note in the bot comment so devs are aware they may choose to dismiss violations related to the warn mode policy.
  • Indicate which violations are in Warn mode (therefore dismissable).
  • Also include a note regarding any settings that are non-compliant per the policy.

Proposed Copy:

Grant Hickman, this merge request has policy violations and errors. To unblock this merge request, fix these items:

  • Resolve all violations in the following merge request approval policies: Block SAST & SD Vulns, SLA-based Vulnerability Remediation. If you think these items shouldn't be violations, ask eligible approvers of each policy to approve this merge request.
  • Consider resolving all security scan violations in the following Warn mode merge request approval policies: Warn mode policy test. If you think these shouldn't be violations, you may dismiss them using the "Bypass" button in the merge check widget and by supplying your reasoning for the dismissal.
  • Consider addressing all settings in violation of the following Warn mode merge request approval policies: Warn mode policy test.

⚠️ Violations blocking this merge request

This merge request introduces these violations:

  1. Critical - RSA private key - Line 12 README.md (Secret detection)
  2. Medium - RSA private key - Line 14 README.md (Secret detection)
  3. (Warn) Low - RSA private key - Line 54 README.md (Secret detection)

[i] Comparison pipelines

  • Target branch (master): #1234345
  • Source branch (g.hickman-branch): #4566790

Settings violating a Warn mode policy:

  1. Prevent approvals by authors should be set to true
  2. Prevent approvals by commit authors should be set to true
  3. Pushing and force pushing should be set to "No One" in your repository settings
  4. Require password to approve should be set to true

Relevant links

Non-functional requirements

  • Documentation:
  • Feature flag:
  • Performance:
  • Testing:

Implementation plan

Verification steps

Edited by 🤖 GitLab Bot 🤖