Add allow_failure toggle to scan execution policy editor

Alan (Maciej) Paruszewskirequested to merge
604648-allow-failure-policy-editor-toggle into master

What does this MR do and why?

This MR adds the policy editor UI for the allow_failure scan execution policy scan setting. A new toggle — Fail the pipeline if a scan job fails — appears on the scan action, next to the existing before/after script toggle.

  • Enabling the toggle writes scan_settings.allow_failure: false, so a failed scan job fails the pipeline (making the scan enforceable through merge request approval policies).
  • Leaving it off preserves the scan template default, so new and edited policies keep allow_failure: true unless enforcement is explicitly enabled.
  • The existing before/after script toggle component was generalized so both scan settings render and merge independently — toggling one no longer clears the other.

Dependency

Depends on !243969 (backend allow_failure scan setting + JSON schema validation). This UI writes the setting that the backend MR validates and applies, so it should merge after that MR.

Related issue

#604648

Screenshots or screen recordings

Before After
No allow_failure toggle on the scan action New Fail the pipeline if a scan job fails toggle on the scan action

Screenshot to be attached after local UI verification.

How to set up and validate locally

  1. Check out this branch (on top of !243969, or after it merges).
  2. Open the scan execution policy editor for a project or group.
  3. Add a scan action and enable the Fail the pipeline if a scan job fails toggle.
  4. Confirm the generated YAML shows scan_settings.allow_failure: false, that disabling it removes the key, and that it does not affect the before/after script toggle.

Tests

  • ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/action/scan_filters/scan_settings_toggle_spec.js — the generalized toggle emits the setting key/value and remove events.
  • ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/action/scan_action_spec.js — both toggles render, the allow_failure selected state (only when allow_failure === false), and independent merge/removal of the two scan settings.
  • ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/from_yaml_spec.js — allow_failure: false YAML round-trip.

Merge request reports