Add audit events for GitLab Duo code review decisions

What does this MR do and why?

GitLab Duo code review can now approve a merge request or request changes on it, but these decisions leave no audit trail. Requested changes and their override only create system notes, and a GitLab Duo approval only streams the generic merge_request_approval_operation event. This merge request adds three audit event types, saved to the database and streamed:

  • duo_code_review_approved and duo_code_review_changes_requested, authored by the GitLab Duo bot, when the approval or the request for changes succeeds. The duo_code_review_changes_requested event records whether override_requested_changes is already on, because the override stays set and GitLab Duo's new request then does not block the merge.
  • duo_code_review_requested_changes_overridden, authored by the user, when a user overrides requested changes while GitLab Duo is one of the reviewers that requested them.

A GitLab Duo approval still streams merge_request_approval_operation as well, so existing streaming consumers that filter on that event keep seeing GitLab Duo approvals.

References

gitlab-org#23854

Screenshots or screen recordings

Before After

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Phil Hughes

Merge request reports

Loading
Loading