Add dependency firewall policy service layer integration
What does this MR do and why?
Add dependency firewall policy service layer integration
Integrates dependency_firewall_policy into the security orchestration policy service layer by:
- Adding dependency_firewall_policy case to PersistPolicyService relation_scope method
- Adding comprehensive test coverage for dependency_firewall_policy persistence
- Adding tests for policy limit and policy type name retrieval
Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/589594
References
How to set up and validate locally
- Setup a Vulnerability Management Policy in your GDK.
- Verify that the
SELECT * FROM security_policies;query returns only one policy. Note down thesecurity_orchestration_policy_configuration_id. - Enable the feature flag
:dependency_firewall_phase1=>Feature.enable(:dependency_firewall_phase1) - Manually modify the policy YAML file in the security policy project. Add the following dependency firewall policy and create an MR:
dependency_firewall_policy:
- name: Block copyleft
description: Prevent copyleft-licensed packages from being downloaded
enabled: true
enforcement_type: enforced
rules:
- type: license
denied:
- name: NIST Software License
- name: NTP License
exceptions:
- purl: pkg:npm/my-internal-lib
bypass_settings:
access_tokens:
- id: 333
- name: Approved licenses
description: Warn on any package whose license is not on the allowed list
enabled: true
enforcement_type: warn
rules:
- type: license
allowed:
- name: MIT License
- name: Apache License 2.0
exceptions:
- purl: pkg:npm/my-internal-lib
bypass_settings:
users:
- id: 123- Merge the policy changes MR
- The policies should have been updated now. There should be 3 rows returned when you perform the
SELECT * FROM security_policies WHERE security_orchestration_policy_configuration_id == <>;query now.
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Related to #589594
Edited by Arpit Gogia