Skip to content

Add warning on project/group with invalid policy.yml file

What does this MR do and why?

This MR adds a warning banner that displays on security policy pages when a project or group has an invalid policy.yml file in their linked security policy project.

When security policies cannot be enforced due to invalid YAML syntax in the policy configuration file, users now see a clear warning message with a direct link to the problematic file, helping them quickly identify and resolve the issue.

Changes include:

  • New InvalidPolicyYamlBanner Vue component that displays a danger alert
  • Integration of the banner into the policies list header
  • Backend helper updates to include policy YAML validation status and file path
  • Comprehensive test coverage for both frontend and backend changes

Changelog: added EE: true

References

Related to #562012

Screenshots or screen recordings

Before After
Screenshot_2025-09-23_at_23.49.45 image

How to set up and validate locally

  1. Create or navigate to a project/group with a linked security policy project
  2. In the security policy project, create an invalid policy.yml file with malformed YAML syntax:
    # Example of invalid YAML - missing closing bracket
    scan_execution_policy:
      - name: "Test Policy"
        enabled: true
        rules:
          - type: pipeline
            branches: [main
  3. Navigate to the project's Security & Compliance > Policies page
  4. Verify that the red warning banner appears with the message "Invalid policy.yml file"
  5. Click the "policy.yml" link in the banner to confirm it navigates to the correct file
  6. Fix the YAML syntax in the policy file and refresh the page to confirm the banner disappears

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Alan (Maciej) Paruszewski

Merge request reports

Loading