Skip to content

Make a request to SpamCheck before creating/updating milestones

Hinam Mehra requested to merge sec-auto/9-onboard-milestones-to-spamcheck into master

What does this MR do and why?

This MR onboards Milestones to Spam Check. The current version of Spam Check will always return an ALLOW verdict for any Generic Spammable. This will allow us to analyze the results before implementing more restrictive actions.

Only Milestones created in public projects/groups will be checked for spam.

Issue: https://gitlab.com/gitlab-org/gl-security/security-engineering/security-automation/spam/spamcheck/-/issues/9

Epic: https://gitlab.com/groups/gitlab-org/-/epics/10118

Screenshots or screen recordings

calls-to-spam-check

How to set up and validate locally

  1. Enable Spam Check in GDK. You don't need to set-up Recaptcha
  2. Create a Milestone in a public project or group. You should see logs emitted from the Spam Check container showing that the Milestone was checked for spam.
  3. Update the title or description of the Milestone. This should result in another call to Spam Check.
  4. You can also try Promoting a Milestone from a private project to a public group. That should also trigger a call to Spam Check.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Hinam Mehra

Merge request reports