Skip to content

Add deprecated warning for approval policies

What does this MR do and why?

This MR adds a deprecated warning for approval policies

This MR adds a deprecated_policy field behind the security_policies_breaking_changes feature flag to indicates if a policy is deprecated.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #446268

Screenshots or screen recordings

Screenshot_2024-03-07_at_7.15.35_AM

How to set up and validate locally

  1. Enable the feature flag
echo "Feature.enable(:security_policies_breaking_changes)" | rails c
  1. Create a new project
  2. Add a new member to the project with developer access
  3. Go to Secure > Policies
  4. Click on New policy
  5. Select Merge request approval policy
  6. Change to .yaml mode
  7. Copy the yaml below:
type: approval_policy
name: Deny MIT
enabled: true
rules:
  - type: license_finding
    match_on_inclusion: true
    license_types:
      - MIT License
    license_states:
      - newly_detected
    branch_type: default
actions:
  - type: require_approval
    approvals_required: 1
    role_approvers:
      - developer
  1. Click on Configure with a merge request
  2. Merge the new MR to add the policy
  3. Go to /-/graphql-explorer
  4. Add a query like:
{
  project(fullPath: "root/test-mr-146520") {
    approvalPolicies {
      nodes {
        name
        deprecatedProperties
      }
    }
  }
}
  1. Verify the deprecatedProperties is ["match_on_inclusion", "newly_detected"]
  2. Go to Secure > Policies
  3. Update the policy with the content below to remove the deprecated fields :
type: approval_policy
name: Deny MIT
enabled: true
rules:
  - type: license_finding
    match_on_inclusion_license: true
    license_types:
      - MIT License
    license_states:
      - detected
    branch_type: default
actions:
  - type: require_approval
    approvals_required: 1
    role_approvers:
      - developer
  1. Repeat the steps 11 and 12
  2. Verify the deprecatedPolicy is empty
Edited by Marcos Rocha

Merge request reports