Grant auditors read access to security scan profiles

Diane Russelrequested to merge
dlrussel/auditor-read-security-scan-profiles into master

What does this MR do and why?

Adds read_security_scan_profiles to the auditor role for projects and groups.

Auditors have read-only access to all groups and projects and already have read_security_inventory. !258018 (merged) gates triage and remediation coverage on read_security_scan_profiles, so without this auditors are refused coverage data. Create, update, apply and delete stay separate permissions the auditor does not get.

Auditor permissions are loaded from config/authz/roles/auditor.yml, so no policy code changes. The specs drop the permission from the auditor read exclusion lists and add auditor cases for the scan profile policy, the trigger_type filter and withTriageCoverage.

References

Screenshots or screen recordings

No UI change.

How to set up and validate locally

  1. With an Ultimate license, attach a triage and remediation scan profile to a project in a group.

  2. As an auditor, run this query and confirm it returns counts instead of null.

    query {
  group(fullPath: "<group_path>") {
    triageAndRemediationCoverageCounters(triggerType: SAST_FALSE_POSITIVE) { enabledCount autoCount }
  }
}

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code

Merge request reports