Refactor security policy bot permissions to use YAML format

Andy Schoenenrequested to merge
594740-refactor-security-policy-bot-permissions-to-use-yaml-format into master

Summary

We want to enable security policy bot users to download artifacts. In order to do this, we need to implement these steps:

  1. ➡️ This MR: Refactor security bot user permissions to use YAML format so we can see all permissions in one place
  2. Change security policy bot role from guest to minimal access
  3. Grant the api_access permission

More details here: #577916 (closed)

What does this MR do?

  1. Refactors bot permissions to YAML format — Moves the bot's project-scoped permissions from three hardcoded DeclarativePolicy rules into config/authz/roles/security_policy_bot.yml, following the pattern used by auditor.yml and other role files.

  2. Adds :read_build permission — Required for artifact downloads (reading build information).

  3. Adds prevent :create_vulnerability_state_transition to the ~security_dashboard_enabled block — Ensures this permission is correctly gated when the security dashboard feature is disabled.

There should be no user visible change.

Behavioral changes

  • DAST scan permissions are now additionally gated by project_allowed_for_job_token_by_scope — Previously gated only on on_demand_scans_enabled & security_policy_bot, now also requires job token scope when authenticating via CI job token. This is a slight tightening (more secure). The ~on_demand_scans_enabled prevent rule still blocks DAST when the feature is disabled.

Permissions in YAML role file

Permission Purpose Previously
build_download_code Download build artifacts Existing
create_bot_pipeline Create bot-triggered pipelines Existing
create_on_demand_dast_scan Trigger on-demand DAST scans Existing (moved)
create_pipeline Create CI pipelines Existing
create_vulnerability_state_transition Transition vulnerability states Existing (moved)
read_build Read build/job information New
read_on_demand_dast_scan Read DAST scan results Existing (moved)

MR acceptance checklist

  • Tests added for new behavior (read_build, DAST permissions)
  • All pre-commit hooks pass (rubocop, yamllint, secrets-detection, permissions_docs)
  • Follows existing patterns (auditor.yml for YAML role)

Related to #577916 (closed)

Edited by Andy Schoenen

Merge request reports