Fix the error when enabling security scans with a MR
What does this MR do and why?
This MR updates the Security::CiConfiguration::BaseCreateService to load the existing CI content using
Gitlab::Ci::Config::Yaml.load!. as recommended in this comment.
This change resolves the issue that prevented projects with existing CI files containing the !reference tag from enabling security scans using the Security configuration Configure with a merge request feature.
It appears that this also enables projects with existing CI that contain YAML anchors to utilize the Configure with a merge request feature.
References
Related to: #368951
Screenshots or screen recordings
| Before | After |
|---|---|
![]() |
![]() |
How to set up and validate locally
- Create a new group
- Create a new project in the group
- Add a file
templates/.gitlab-ci-example1.ymlwith the content:
.check-variable-bash:
script:
- echo creating environment
- Create another project in the group
- Add a
.gitlab-ci.ymlfile with the content:
include:
- project: '<group/project-created-on-step-2>'
file: '/templates/.gitlab-ci-example1.yml'
test:
script:
- !reference [.check-variable-bash, script]
- Go to Secure > Security configuration
- Go to the Dependency Scanning section
- Click on
Configure with a merge request - Verify that a new MR is created
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Edited by Marcos Rocha

