Disallow editing of project-level MR approval settings that are enabled at the instance level

Merged Tan Le requested to merge 273765-disallow-editing-project-level-mr-settings into master

What does this MR do?

This change effectively reinstates the instance-level MR approval settings effects on project-level ones. This was introduced before this issue but the behaviour subsequently has been evolved to just allow scoping of MR approval settings on compliance-labelled projects. As per feedback from one of our high-value customers, the current behaviour is not desirable as it breaks the global control on developer projects.

Timeline of this feature

  • 2020-02-17: [12.8] Disable self-approval at the Instance level Issue <-- we would like to get back here
  • 2020-04-24: [13.1] Instance-level MR approvals settings no longer affect project-level ones. Issue - MR
  • 2020-05-20: [13.1] Revert maintainer permission lock-down MR
  • 2020-06-19: [13.2] Allow admins to scope admin-level MR approval settings to compliance-labeled projects Issue - MR
  • 2020-07-13: [13.2] GA scope admin-level MR approval settings MR
  • 2020-10-21: [13.5] Fix the issue where modification of project-level MR approval rules is locked due to the instance-level MR approval settings. Issue, see Matt's comment about reverting this. MR <-- we are currently here

Before this MR

  • Instance-level MR approval settings are scoped only to compliance-labelled projects.
  • Project-level MR approval rules are not controlled by instance-level

After this MR

  • Instance-level MR approval settings (once enabled) will
    • Disallow editing of project-level ones to any role
    • Project-level MR approval settings will reflect instance-level MR approval settings as SSOT
  • Instance-level MR approval settings (once disabled) will
    • Allow editing of project-level ones to maintainer and above
    • Project-level MR approval settings will reflect project-level MR approval settings as SSOT
  • Project-level MR approval rules is also controlled by instance-level

🎈 Breaking changes: 🎈 Instance-level MR approvals settings can no longer be scoped to compliance-labelled projects.

Note to maintainer: we would like to additionally pick this change to %13.5 as a new release patch.


Before (Instance-level) After (Instance-level)
instance-level-before instance-level-after

Does this MR meet the acceptance criteria?


Availability and Testing


If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team

Related to #273765 (closed)

Edited by Tan Le

Merge request reports