Add skipped security policies pipelines audit event

What does this MR do and why?

This MR adds audit events for skipped pipelines where scan_execution or pipeline_execution policies should be enforced.

References

Related to: #539232 (closed)

How to set up and validate locally

1. Enable the feature flag collect_security_policy_skipped_pipelines_audit_events using the rails console

Feature.enable(:collect_security_policy_skipped_pipelines_audit_events)

2. Create a new group
3. Create a new project in the group
4. Add a CI config file policy-ci.yml with the content

pipeline execution policy job:
  stage: .pipeline-policy-pre
  script:
    - echo "Enforce your policy here"

5. Add a .gitlab/security-policies/policy.yml file with the content:

---
pipeline_execution_policy:
- name: test
  description: ''
  enabled: true
  pipeline_config_strategy: override_project_ci
  content:
    include:
    - project: <path-to-your-project>/project
      file: policy-ci.yml
  skip_ci:
    allowed: true

6. Go back to the group created on step 2
7. Go to Secure > Policies
8. Click on Edit policy project and select your project.
9. Create another project in the group
10. Go to Secure > Policies
11. Click on New policy
12. Select Scan Execution Policy
13. Create a policy with skip_ci enabled:

scan_execution_policy:
  - name: sep-skip-ci-test
    description: ''
    enabled: true
    rules:
      - type: pipeline
        branch_type: default
    actions:
      - scan: secret_detection
        variables:
          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
    skip_ci:
      allowed: true

14. Click on Create new project with the new policy
15. Merge the new MR to add the policy
16. Create a private webhook receiver.

16.1. Create a script called print_http_body.rb

require 'webrick'

server = WEBrick::HTTPServer.new(:Port => ARGV.first)
server.mount_proc '/' do |req, res|
  puts req.body
end

trap 'INT' do
  server.shutdown
end
server.start

16.2. Start the script

ruby print_http_body.rb 8000

17. Go to Admin > Monitoring > Audit events
18. Click on the Streams tab
19. Click on Add streaming destination
20. Click on HTTP endpoint
21. Set the destination URL to your listener e.g: http://localhost:8000/
22. In event filtering select Policy pipeline skipped
23. Click on Add
24. Go back to the project created on step 9
25. Create a MR editing the README.md file with commit message containing [skip ci]
26. Verify that NO pipeline is created
27. Verify the audit event was received in your private listener

{
  "id": "dadc4fed-a6da-4f8f-b886-b8bb352b9d98",
  "author_id": 1,
  "entity_id": 135,
  "entity_type": "Project",
  "details": {
    "merge_request_title": "[skip ci]Edit README.md",
    "merge_request_id": 354,
    "merge_request_iid": 1,
    "source_branch": "root-main-patch-20460",
    "target_branch": "main",
    "project_id": 135,
    "project_name": "sep-project",
    "project_full_path": "test-skip-execution-policies-audit-event/sep-project",
    "skipped_policies": [
      {
        "name": "sep",
        "policy_type": "scan_execution_policy"
      },
      {
        "name": "sep-skip-ci-test",
        "policy_type": "scan_execution_policy"
      },
      {
        "name": "test",
        "policy_type": "pipeline_execution_policy"
      }
    ],
    "event_name": "policy_pipeline_skipped",
    "author_name": "Administrator",
    "author_class": "User",
    "target_id": 919,
    "target_type": "Ci::Pipeline",
    "target_details": "unknown",
    "custom_message": "Pipeline: 919 with security policy jobs skipped",
    "ip_address": "172.16.123.1",
    "entity_path": "test-skip-execution-policies-audit-event/sep-project"
  },
  "ip_address": "172.16.123.1",
  "author_name": "Administrator",
  "entity_path": "test-skip-execution-policies-audit-event/sep-project",
  "target_details": "unknown",
  "created_at": "2025-06-30T22:40:08.489Z",
  "target_type": "Ci::Pipeline",
  "target_id": 919,
  "event_type": "policy_pipeline_skipped"
}

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.