Skip to content

Enable interactive yaml validation for policies

Alexander Turinske requested to merge 357877-interactive-policy-validation into master

What does this MR do and why?

Enable interactive yaml validation for single policy creation in the policy editor

  • security policies can be created via yaml mode
  • the yaml has specific fields that can be added as well as types for those fields
  • utilize a schema to notify users when they have incorrectly input a field

Changelog: added

EE: true

Technical Details

There are two places that need validation:

  1. For a single policy being created on the policy editor (where users should be creating new security policies) (this MR)
  2. For multiple policies in the file where the policy editor saves to (<security_policy_project>/.gitlab/security-policies/policy.yml) (future MR)

The differences can be seen in this discussion

The backend already had a schema for multiple policies (for other reasons), so I am resusing that schema for the single policy (which is slightly different for reasons), thus, I request the schema, modify it slightly, and then use the schema field to submit it.

Screenshots or screen recordings

Page Field Screenshot
Scan Execution Policy Editor - Project type Screen_Shot_2022-06-27_at_18.51.49 (i.e. validation does exist)
Scan Execution Policy Editor - Project name Screen_Shot_2022-06-27_at_18.51.40 (i.e. validation does exist)
Scan Execution Policy Editor - Group - Screen_Shot_2022-07-12_at_13.30.46
Scan Result Policy Editor - Screen_Shot_2022-07-06_at_22.39.58 (i.e. validation does not exists)
Scan Execution Policy Drawer - Screen_Shot_2022-07-06_at_22.41.04 (i.e. validation does not exist)
Scan Result Policy Drawer - Screen_Shot_2022-07-06_at_23.16.25 (i.e. validation does not exist)

How to set up and validate locally

  1. Upload a GitLab Ultimate license
  2. Navigate to a project => Security & Compliance => Policies => New Policy => Scan Execution Policy

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #357877 (closed)

Edited by Alexander Turinske

Merge request reports