[FF] `approval_policies_block_on_failed_scan_job`

Summary

Roll out the feature currently behind the approval_policies_block_on_failed_scan_job feature flag.

DRI: @alan
Team Slack channel: #g_security_policies

Note

Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. Feature flag controls · Feature flag lifecycle

What could go wrong?

The new guard blocks a merge request when a scanner required by an MR approval policy has a failed CI job that produced no security report. Misdetection (for example, misreading the artifacts:reports: declaration, or flagging a scanner outside the policy's scope) could cause merge requests to be unexpectedly blocked (fail: closed) or unexpectedly passed through (fail: open). Detect via increased policy-violation / required-approval activity on UpdateApprovalsService, and reports from users about approvals being unexpectedly required or missing.

Rollout

Run all production /chatops in #production and cross-post the results to #g_security_policies. Background: incremental rollout process, feature actors.

Non-production

/chatops gitlab run feature set approval_policies_block_on_failed_scan_job 50 --actors --dev --pre --staging --staging-ref
/chatops gitlab run feature set approval_policies_block_on_failed_scan_job true --dev --pre --staging --staging-ref

Production — percentage rollout (wait ≥15 min between steps, watch dashboards):

/chatops gitlab run feature set approval_policies_block_on_failed_scan_job <percentage> --actors

Or target specific actors instead:

/chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss approval_policies_block_on_failed_scan_job true
/chatops gitlab run feature set --group=gitlab-org,gitlab-com approval_policies_block_on_failed_scan_job true
/chatops gitlab run feature set --user=alan approval_policies_block_on_failed_scan_job true

Before global rollout

Confirm the relevant gotchas before going to 100% — see enabling a feature for GitLab.com:

Docs + version history updated
Breaking changes announced, if any
Change management issue opened, if required
External API consumers handled with a fail-open mechanism, if applicable

Cleanup

Remove the flag once deemed stable — see cleaning up. Track it here, or open a follow-up Feature Flag Cleanup issue. Remove the flag and its YAML definition from the codebase, then:

/chatops gitlab run release check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/243540 19.2
/chatops gitlab run feature delete approval_policies_block_on_failed_scan_job --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set approval_policies_block_on_failed_scan_job false                                         # production
/chatops gitlab run feature set approval_policies_block_on_failed_scan_job false --dev --pre --staging --staging-ref     # non-production
/chatops gitlab run feature delete approval_policies_block_on_failed_scan_job --dev --pre --staging --staging-ref --production  # remove entirely

[FF] approval_policies_block_on_failed_scan_job