Skip to content

Prevent delete protected branches via security policies

What does this MR do and why?

This prevents the deletion of a protected branch on the project level when a security policy enables the block_unprotecting_branches setting as described in #420728 (closed)

Note: This MR only addresses the backend changes. I suggested hiding the Delete protected branch button here to avoid confusion.

How to set up and validate locally

  1. Enable the feature flag Feature.enable(:scan_result_policies_block_unprotecting_branches)
  2. Create a project
  3. Create a scan result policy via Secure -> Policies -> New policy
  4. Switch to .yaml mode and paste the following yaml:
    type: scan_result_policy
    name: Container Scanning
    description: ''
    enabled: true
    rules:
      - type: scan_finding
        scanners:
          - container_scanning
        vulnerabilities_allowed: 0
        severity_levels: []
        vulnerability_states: []
        branch_type: protected
    actions:
      - type: require_approval
        approvals_required: 1
        user_approvers_ids:
          - 1
    approval_settings:
      block_unprotecting_branches: true
  5. Select Configure with a merge request and merge the MR
  6. Create a new branch on the project
  7. Make the branch protected via Settings -> Repository -> Protected branches
  8. Go to Code -> Branches and try to delete the protected branch
  9. This should fail with an error message saying: "Deleting protected branches is blocked by security policies"

Screenshots

Screenshot
Screenshot_2023-09-25_at_11.37.10

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #420728 (closed)

Edited by Andy Schoenen

Merge request reports