Draft: POC allow excluding packages MRAP
What does this MR do and why?
Related to: #494722
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Before | After |
---|---|
How to set up and validate locally
- Create a new project
- Add an empty Gemfile.lock file
- Add a file called
gl-sbom-gem-bundler.cdx.json
with the content
{
"bomFormat": "CycloneDX",
"specVersion": "1.4",
"serialNumber": "urn:uuid:a15e529c-2113-4a11-a694-6bc3ea4e2b53",
"version": 1,
"metadata": {
"timestamp": "2022-02-23T08:02:39Z",
"tools": [
{
"vendor": "GitLab",
"name": "Gemnasium",
"version": "2.34.0"
}
],
"authors": [
{
"name": "GitLab",
"email": "support@gitlab.com"
}
],
"properties": [
{
"name": "gitlab:dependency_scanning:input_file:path",
"value": "Gemfile.lock"
},
{
"name": "gitlab:dependency_scanning:package_manager:name",
"value": "bundler"
},
{
"name": "gitlab:meta:schema_version",
"value": "1"
}
]
},
"components": [
{
"name": "sidekiq",
"version": "4.2.10",
"purl": "pkg:gem/sidekiq@4.2.10",
"type": "library",
"bom-ref": "pkg:gem/sidekiq@4.2.10",
"licenses": [
{
"license": {
"name": "Custom-License"
}
}
]
}
]
}
- Add a
.gitlab-ci.yml
with the content
include:
- template: Jobs/Dependency-Scanning.gitlab-ci.yml
gemnasium-dependency_scanning:
stage: test
script: 'pwd'
artifacts:
reports:
cyclonedx: gl-sbom-gem-bundler.cdx.json
- Go to Build > Pipelines
- Click on the last pipeline
- Click on the Licenses tab
- Verify the license for the sidekiq was detected
- Go to Secure > Policies
- Click in New policy
- Select Merge request approval policy
- Change to the yaml mode and copy the policy content below:
type: approval_policy
name: abcd
description: ''
enabled: true
rules:
- type: license_finding
match_on_inclusion_license: true
license_types:
- LGPL-3.0
license_states:
- detected
branches: []
licenses:
denied:
- name: LGPL-3.0
packages:
excluding:
- name: sidekiq
actions:
- type: require_approval
approvals_required: 1
role_approvers:
- maintainer
- type: send_bot_message
enabled: true
approval_settings:
block_branch_modification: true
prevent_pushing_and_force_pushing: true
prevent_approval_by_author: true
prevent_approval_by_commit_author: true
remove_approvals_with_new_commit: true
require_password_to_approve: false
fallback_behavior:
fail: closed
- Click in configure with a merge request
- Merge the policy
- Create an MR modifying the README file
- Verify that MR is not blocked
Edited by Marcos Rocha