Fix invalid pipelines for scan execution policies

What does this MR do and why?

This MR prevents the creation of merge requests pipelines for scan execution policy scans when the policy does not apply to the branch.

References

Related to #526355 (closed)

Screenshots or screen recordings

Before After
Screenshot_2025-03-25_at_6.17.51_PM Screenshot_2025-03-25_at_6.18.01_PM

How to set up and validate locally

  1. Create a new project without a .gitlab-ci.yml file
  2. Ensure the Auto DevOps is disabled(Settings > Ci/CD > Auto DevOps)
  3. Go to Secure > Policies
  4. Click on New policy
  5. Select Scan Execution Policy
  6. Create a policy to run a secret_detection scan with the default template for the default branch:
scan_execution_policy:
  - name: sep
    description: ''
    enabled: true
    rules:
      - type: pipeline
        branch_type: default
    actions:
      - scan: secret_detection
    skip_ci:
      allowed: true
      allowlist:
        users: []
  1. Click on Configure with a merge request
  2. Merge the new MR to add the policy
  3. Create a MR editing the README.md file
  4. Verify that no pipeline is created
  5. Merge the MR
  6. Verify the MR is created for the default branch

Optional: Repeat the steps of !179614 (merged) to ensure it also work with the latest template and MR pipelines.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Marcos Rocha

Merge request reports

Loading