Skip to content

Auto accept terms for security_policy_bot users

What does this MR do and why?

This MR fixes an issue where scheduled pipelines from scan execution policies are not created when terms are enforced on the instance.

How to set up and validate locally

  1. Enforce the terms of service and privacy policy under admin/application_settings/general
  2. Enable the scan_execution_bot_users feature flag.
  3. Prepare the test project. Follow the steps below or clone https://gitlab.com/gitlab-org/govern/security-policies/andys-test-group/scan-execution-policy-test
    1. Create a new project with a working .gitlab-ci.yml file. For example, use the bash template.
    2. Add an empty named package.json to the project. This is required for the SAST scan to run.
    3. On the left sidebar select Repository and Branches
    4. Select New branch
    5. Enter test as name
    6. Select Create branch
  4. Prepare the security policy
    1. On the left sidebar, select Security and Compliance* and Policies.
    2. Select New policy.
    3. Select Scan execution policy
    4. Switch to .yaml mode
    5. Replace the content with the example policy yaml below
    6. Select Configure with a merge request
    7. Select Merge.
    8. Go back to your initial project
    9. There should now be a bot member named GitLab Security Policy Bot.
  5. Wait for the next full hour until the scheduled pipeline is triggered, or trigger the job manually:
    Security::OrchestrationPolicyRuleSchedule.last.update_columns next_run_at: 1.day.ago
    Security::OrchestrationPolicyRuleScheduleWorker.new.perform
  6. View the pipelines page of your project
  7. There should be a new pipeline triggered by the GitLab Security Policy Bot
  8. The pipeline should pass For public projects, the pipeline should pass. For private project, a follow-up MR fixes access for security_policy_bot

Example policy yaml

type: scan_execution_policy
name: test
description: ''
enabled: true
rules:
  - type: schedule
    branches:
      - test
    cadence: 0 * * * *
actions:
  - scan: sast
    tags: []

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #414278 (closed)

Edited by Martin Čavoj

Merge request reports