Skip to content

Require project membership for merge request approvals

Sincheol (David) Kim requested to merge 365278-non-eligible-user-able-to-create-and-approve-mrs into master

What does this MR do and why?

Related to #365278 (closed)

MRs from a forked public project can be approved by the author unintentionally. Our doc mentions that a membership is required so users without a membership shouldn't be able to approve.

How to set up and validate locally

  1. Fork a public project that you are not a member of
  2. Make a commit to your forked project
  3. Create a merge request and set the forked project as the source project and original project as the target project.
  4. Verify that Approve button does not appear

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #365278 (closed)

Merge request reports