Skip to content

Add policy toggle unblock_rules_using_scan_execution_policies

What does this MR do and why?

Add a new toggle for approval policy rules to get unblocked when the same scanner is enforced by scan execution policies. It's behind a feature flag unblock_rules_using_execution_policies

References

Please include cross links to any resources that are relevant to this MR This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Metrics:

CleanShot_2024-10-28_at_18.20.08_2x

How to set up and validate locally

  1. In rails console enable the feature flag
    Feature.enable(:unblock_rules_using_execution_policies)
  2. Create a project
  3. In the project, create a new Scan execution policy to run dependency_scanning on every pipeline
  4. Create approval policy to require approvals based on dependency_scanning scans. Switch to the .yaml mode and add policy_tuning section:
    policy_tuning:
      unblock_rules_using_execution_policies: true
  5. Update README.md in a MR
  6. Verify that approvals are not required, even though the scans didn't run
  7. Disable the toggle or feature flag and verify that approvals are required, and policy bot violations appear with "missing scans"

Related to #490092 (closed)

Edited by Martin Cavoj

Merge request reports

Loading