GraphQL 500 when a policy violation carries the EVALUATION_SKIPPED status reason (missing enum value)

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Work on this issue

Summary

Security::ScanResultPolicyViolation records can carry a status_reason value of evaluation_skipped. The GraphQL enum used to expose that field, PolicyViolationErrorType, does not define a corresponding value. Queries that read the field on a violation with that status reason return an HTTP 500 rather than degrading to UNKNOWN or exposing the actual value.

Source references

The enum currently defines four values:

• File: ee/app/graphql/types/security_orchestration/policy_violation_error_type_enum.rb
• Values present: SCAN_REMOVED, ARTIFACTS_MISSING, SCAN_NOT_SUCCEEDED, UNKNOWN
• Value missing: EVALUATION_SKIPPED

The evaluation_skipped status is set on the model in the UnblockPendingMergeRequestViolationsWorker code path documented in #627280.

Impact

A user running GraphQL queries against merge request policy violations receives a server error rather than data when any violation in the result set carries EVALUATION_SKIPPED. This surfaced in the field as an inability to enumerate blocked merge requests programmatically during a live event where EVALUATION_SKIPPED was the dominant status.

Suggested fix

Add EVALUATION_SKIPPED to the enum with an appropriate description. If there is a design reason not to expose it as a distinct value, map it to UNKNOWN at the resolver layer so the query does not 500.

References

• Related root-cause issue: #627280
• Internal support ticket with full context: ZD-747134