Resolve "Introduce merge check for policy violations"

What does this MR do and why?

If there is a policy violation, we need to block the MR until this violation has been resolved.

To test

  1. Turn on feature flag policy_mergability_check and ensure you have a Docker runner

  2. In the project, ensure that main is a protected branch.

  3. Create .gitlab-ci.yml:

    include:
      - template: Jobs/Secret-Detection.gitlab-ci.yml
    
    test-job:
      stage: test
      script:
        - echo "Testing"
  4. Go to Secure -> Policies -> New policy. Select "Merge request approval policy".

  5. Switch to the .yaml mode and use the following YAML:

    type: approval_policy
    name: Security
    description: ''
    enabled: true
    rules:
      - type: scan_finding
        scanners: []
        vulnerabilities_allowed: 0
        severity_levels: []
        vulnerability_states: []
        branch_type: protected
    actions:
      - type: require_approval
        approvals_required: 1
        role_approvers:
          - developer
    approval_settings:
      block_branch_modification: true
      prevent_pushing_and_force_pushing: true
      prevent_approval_by_author: true
      prevent_approval_by_commit_author: true
      remove_approvals_with_new_commit: true
      require_password_to_approve: false
    fallback_behavior:
      fail: closed
    
  6. Configure with a merge request && merge

  7. Go back to the project and open a new MR

  8. The MR should be blocked with security evaluation check and the security rule is optional

  9. Create a .env file with `AWS_TOKEN=AKIAZYONPI3G4JNCCWGQ'

  10. Push, and wait for the CI to run, and the mergeability check should fail

  11. Fix the violation by removing the token and push

  12. The MR should not fail the violation check

Related to #478861 (closed)

Edited by Marc Shaw

Merge request reports

Loading