[FF] approve_mr_on_group_protected_branches -- Allow MR approval on group-level protected branches

Summary

Roll out the feature currently behind the approve_mr_on_group_protected_branches feature flag.

Note

Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. Feature flag controls · Feature flag lifecycle

What could go wrong?

Blast radius is small: the flag only affects who may approve a merge request when the target branch is protected at the group level (inherited). When disabled, behavior is exactly as today (project-level protected branches only). When enabled, users granted approval permission via a group approval rule can also approve on group-protected branches. No data-loss risk. The permission check is evaluated per-MR in the GraphQL userPermissions { canApprove } path for non-members; the underlying query is a single indexed EXISTS (query plans in !244265 (merged)), so watch the #code_review and Rails request dashboards on https://dashboards.gitlab.net for any latency regression during rollout.

Rollout

Run all production /chatops in #production and cross-post the results to #g_code_review. Background: incremental rollout process, feature actors.

Non-production

/chatops gitlab run feature set approve_mr_on_group_protected_branches 50 --actors --dev --pre --staging --staging-ref
/chatops gitlab run feature set approve_mr_on_group_protected_branches true --dev --pre --staging --staging-ref

Production — percentage rollout (wait ≥15 min between steps, watch dashboards):

/chatops gitlab run feature set approve_mr_on_group_protected_branches <percentage> --actors

Or target specific actors instead:

/chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss approve_mr_on_group_protected_branches true
/chatops gitlab run feature set --group=gitlab-org,gitlab-com approve_mr_on_group_protected_branches true
/chatops gitlab run feature set --user=patrickbajao approve_mr_on_group_protected_branches true

Before global rollout

Confirm the relevant gotchas before going to 100% — see enabling a feature for GitLab.com:

Cleanup

Remove the flag once deemed stable — see cleaning up. Track it here, or open a follow-up Feature Flag Cleanup issue. Remove the flag and its YAML definition from the codebase, then:

/chatops gitlab run release check <merge-request-url> <milestone>
/chatops gitlab run feature delete approve_mr_on_group_protected_branches --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set approve_mr_on_group_protected_branches false                                         # production
/chatops gitlab run feature set approve_mr_on_group_protected_branches false --dev --pre --staging --staging-ref     # non-production
/chatops gitlab run feature delete approve_mr_on_group_protected_branches --dev --pre --staging --staging-ref --production  # remove entirely