Skip to content

Use license scanning scanner when refreshing approvals

What does this MR do and why?

What

This MR refactors the approval merge request rule so that it utilizes a concrete class of ::Gitlab::LicenseScanning::BaseScanner instead of directly looking for license scanning reports in a pipeline. The report is fetched using the scanners report method instead of a referencing the pipelines license scanning report method.

Why

The change to this interface allows us to switch the implementation details without impacting the results expected. Specifically, groupcomposition analysis is in the process of replacing license-finder so that it is not reliant on pipeline artifacts, and instead can aggregate dependency/license data at the group and project level.

Additional info

  • Create an abstract class that will be used as an interface for license scanning
  • Update the sites that reference license scanning reports to use new interface
  • Add feature flag so that interface switches implementation to SBoM based scanner. See &9400 (closed)

Closes #377420 (closed)

Screenshots or screen recordings

Video showing the merge request widget showing the approvals required in MR widget

Video showing the merge request widget showing the approvals required after removing a denied license policy

How to set up and validate locally

  1. Create a project with license scanning enabled if one does not already exist.
  2. Open an MR and approve the changes.
  3. Create and push a commit to the MR that adds a license and verify that it refreshed the approvals.
  4. Add a new license policy that accepts the license and verify that the approvals have refreshed.
  5. Re-approve the merge request.
  6. Update the recently created license policy so that it denies the license and verify that the approvals have refreshed.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Oscar Tovar

Merge request reports