Skip to content

Add validation to check if branches are valid for security policy

What does this MR do and why?

We're adding new validation to check if provided branches exists for selected project. In this MR we're adding new service to perform this validation that cannot be checked with JSON Schema validator.

We're also moving parts of validation that were introduced in ProcessPolicyService to new validator to keep them in one place, in ProcessPolicyService we're leaving validation that is related to the commit process, new validation service (ValidatePolicyService) is designed to validate single policy correctness.

Screenshots or screen recordings

Screenshot_2022-01-20_at_19.55.00

Screenshot_2022-01-20_at_19.55.28

How to set up and validate locally

  1. Create new project
  2. Go to Security & Compliance -> Policies
  3. Click on New policy
  4. Change policy type to Scan Execution
  5. Use policy to check if validation works:

a.

type: invalid_type
name: 'Test'
description: ''
enabled: true
rules:
  - type: pipeline
    branches:
      - main
actions:
  - scan: dast
    site_profile: ''
    scanner_profile: ''

b.

type: scan_execution_policy
name: 'Test'
description: ''
enabled: true
rules:
  - type: pipeline
    branches: []
actions:
  - scan: dast
    site_profile: ''
    scanner_profile: ''

c.

type: scan_execution_policy
name: 'Test'
description: ''
enabled: true
rules:
  - type: pipeline
    branches:
    - invalid_branch
actions:
  - scan: dast
    site_profile: ''
    scanner_profile: ''

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #339751 (closed)

Edited by Alan (Maciej) Paruszewski

Merge request reports