Part of epic **MR Approval Malware Policy** (gitlab-org/gitlab#19465). PoC: gitlab-org/gitlab!235643. ## Goal Enforce malware blocking — when a scanner is marked `is_malicious: true`, any malware finding blocks the MR regardless of the rule's severity/state filters — **and introduce the feature flag** that gates the feature (this is its first `Feature.enabled?` consumer). ## Scope - `Security::ScanResultPolicies::GroupedFindingsEvaluator`: split into `standard_group_result` + `malicious_group_result`. - `malicious_group_result(scanner_types)` builds finder params `{ scanners: scanner_types, malicious: true, related_pipeline_ids: ... }.compact`. The **supersede** behavior (malware blocks regardless of severity/state filters) is achieved here by **omitting** the other filters — not by a special finder mode (per @mc_rocha review on !239123). - Run the malicious finder branch alongside the standard filter and **OR** the results (`vulnerabilities_allowed: 0`, states nil); standard filters still surface their own violations. - **Introduce** `ee/config/feature_flags/gitlab_com_derisk/security_policies_malware_attribute.yml` (`gitlab_com_derisk`, default off) and guard the malicious path with `Feature.enabled?`. ## Feature flag `security_policies_malware_attribute` — **created in this MR** (moved here from #601955, which had no consumer). Prerequisite for the frontend issue #601960 (`push_frontend_feature_flag`) and any other flag consumer. ## Reviewer notes (from PoC, @mc_rocha) - Prefer a **single OR query in the finder** over calling `FindingsFinder` twice. - Reconsider `unshift` vs `append` ordering cost. - **Owns the supersede logic** pulled out of the finder (#601956): the finder is now a pure `malicious` boolean filter, so this evaluator decides when malware overrides the other filters by constructing a finder call with only `{ scanners:, malicious: true, related_pipeline_ids: }` ([note](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/239123#note_3434313509)). ## Warn-mode Inherits the broad approval-policy warn-mode behavior. Gating the malicious approval requirement on `Security::Policy#warn_mode?` is deferred (see the add-on-removal / warn-mode issue). ## Acceptance criteria - [ ] Malware finding blocks even when severity/state filters would not. - [ ] Standard filters still evaluate independently. - [ ] Flag off → behavior unchanged. ## Tests - Evaluator unit + policy-evaluation integration specs. ## Dependencies Needs **"malware scope + finder mode"** (#601956), **"ScannerConfig + Rule normalization"** (#601957), and the schema acceptance (#601955). Consumes the `malicious:` filter param from #601956 (renamed from `malicious_only`).