From 812778d0f9d137f04279018855cb38ea88eb13a4 Mon Sep 17 00:00:00 2001
From: Alexander Turinske <aturinske@gitlab.com>
Date: Wed, 17 Sep 2025 22:05:45 -0600
Subject: [PATCH 1/4] Remove flexible_scan_execution_policy feature flag

- remove all usage
- update tests

Changelog: changed

EE: true
---
 .../components/policy_editor/constants.js     |   5 +-
 .../scan_execution/editor_component.vue       |  74 +--
 .../policy_editor/scan_execution/lib/index.js |  62 +--
 .../rule/base_rule_component.vue              |  14 +-
 .../groups/security/policies_controller.rb    |   1 -
 .../projects/security/policies_controller.rb  |   1 -
 .../policy_editor/constants_spec.js           | 130 ++---
 .../scan_execution/editor_component_spec.js   | 499 ++++++------------
 .../scan_execution/lib/actions_spec.js        |  12 +-
 .../scan_execution/lib/index_spec.js          |  45 +-
 .../rule/base_rule_component_spec.js          |  20 -
 .../security_orchestration/mocks/mock_data.js |  13 +-
 .../mocks/mock_scan_execution_policy_data.js  |  40 ++
 locale/gitlab.pot                             |   3 -
 14 files changed, 281 insertions(+), 638 deletions(-)

diff --git a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/constants.js b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/constants.js
index 4ed64d576e63a4..7f04a4fe8d4ad1 100644
--- a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/constants.js
+++ b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/constants.js
@@ -217,9 +217,8 @@ export const SCAN_EXECUTION_BRANCH_TYPE_OPTIONS = ({
     SPECIFIC_BRANCHES,
   ];
 
-  // Feature flag dependent options
-  if (window.gon?.features?.flexibleScanExecutionPolicy && includeTargetTypes) {
-    // Additional options when feature flag is enabled
+  // Additional options when it is a pipeline scan
+  if (includeTargetTypes) {
     const additionalOptions = [
       TARGET_PROTECTED_BRANCHES,
       isGroupNamespace ? GROUP_TARGET_DEFAULT_BRANCHES : PROJECT_TARGET_DEFAULT_BRANCH,
diff --git a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue
index 8b27ce603e18ab..22e0a4e9739630 100644
--- a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue
+++ b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue
@@ -203,9 +203,6 @@ export default {
     isDefaultConfig() {
       return this.configType === SELECTION_CONFIG_DEFAULT;
     },
-    hasFlexibleScanExecutionPolicy() {
-      return this.glFeatures.flexibleScanExecutionPolicy;
-    },
     hasNewSplitView() {
       return this.glFeatures.securityPoliciesSplitView;
     },
@@ -390,77 +387,8 @@ export default {
     @update-yaml="updateYaml"
     @update-editor-mode="changeEditorMode"
   >
-    <template #rules>
-      <disabled-section
-        v-if="!hasFlexibleScanExecutionPolicy"
-        :disabled="parsingError.rules"
-        :error="$options.i18n.CONDITION_SECTION_DISABLE_ERROR"
-        data-testid="disabled-rule"
-      >
-        <template #title>
-          <h4>{{ $options.i18n.CONDITIONS_LABEL }}</h4>
-        </template>
-
-        <rule-section
-          v-for="(rule, index) in policy.rules"
-          :key="rule.id"
-          :data-testid="`rule-${index}`"
-          class="gl-mb-4"
-          :init-rule="rule"
-          :rule-index="index"
-          @changed="updateActionOrRule($options.RULE, index, $event)"
-          @remove="removeActionOrRule($options.RULE, index)"
-        />
-
-        <div class="gl-mb-5 gl-rounded-base gl-bg-subtle gl-p-5">
-          <gl-button variant="link" data-testid="add-rule" @click="addRule">
-            {{ $options.i18n.ADD_CONDITION_LABEL }}
-          </gl-button>
-        </div>
-      </disabled-section>
-    </template>
-
-    <template #actions-first>
-      <disabled-section
-        v-if="!hasFlexibleScanExecutionPolicy"
-        :disabled="parsingError.actions"
-        :error="actionSectionError"
-        data-testid="disabled-action"
-      >
-        <template #title>
-          <h4>{{ $options.i18n.ACTIONS_LABEL }}</h4>
-        </template>
-
-        <scan-action
-          v-for="(action, index) in actions"
-          :key="action.id"
-          :data-testid="`action-${index}`"
-          class="gl-mb-4"
-          :init-action="action"
-          :action-index="index"
-          :error-sources="errorSources"
-          @changed="updateActionOrRule($options.ACTION, index, $event)"
-          @remove="removeActionOrRule($options.ACTION, index)"
-          @parsing-error="handleActionBuilderParsingError"
-        />
-
-        <div class="gl-mb-5 gl-rounded-base gl-bg-subtle gl-p-5">
-          <span v-gl-tooltip :title="addActionButtonTitle" data-testid="add-action-wrapper">
-            <gl-button
-              :disabled="addActionButtonDisabled"
-              variant="link"
-              data-testid="add-action"
-              @click="addAction"
-            >
-              {{ $options.i18n.ADD_ACTION_LABEL }}
-            </gl-button>
-          </span>
-        </div>
-      </disabled-section>
-    </template>
-
     <template #actions>
-      <div v-if="hasFlexibleScanExecutionPolicy" class="gl-mt-5">
+      <div class="gl-mt-5">
         <h4>{{ s__('SecurityOrchestration|Scan execution configuration') }}</h4>
         <div class="gl-mb-5">
           <gl-sprintf
diff --git a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/lib/index.js b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/lib/index.js
index c124bf73758947..e8d6bceba5c973 100644
--- a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/lib/index.js
+++ b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/lib/index.js
@@ -22,34 +22,11 @@ export const optimizedConfiguration = `    rules:
     skip_ci:
       allowed: true`;
 
-export const DEFAULT_SCAN_EXECUTION_POLICY_OPTIMIZED = `scan_execution_policy:
-  - name: ''
-    description: ''
-    enabled: true
-${optimizedConfiguration}`;
-
-export const DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_OPTIMIZED = `scan_execution_policy:
-  - name: ''
-    description: ''
-    enabled: true
-    policy_scope:
-      projects:
-        excluding: []
-${optimizedConfiguration}`;
-
 export const DEFAULT_SCAN_EXECUTION_POLICY = `scan_execution_policy:
   - name: ''
     description: ''
     enabled: true
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-    skip_ci:
-      allowed: true
-`;
+${optimizedConfiguration}`;
 
 export const DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE = `scan_execution_policy:
   - name: ''
@@ -58,44 +35,9 @@ export const DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE = `scan_execution_policy:
     policy_scope:
       projects:
         excluding: []
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-    skip_ci:
-      allowed: true
-`;
-
-export const DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_WITH_DEFAULT_VARIABLES = `scan_execution_policy:
-  - name: ''
-    description: ''
-    enabled: true
-    policy_scope:
-      projects:
-        excluding: []
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
-`;
+${optimizedConfiguration}`;
 
 export const getPolicyYaml = ({ isGroup }) => {
-  const { flexibleScanExecutionPolicy } = window.gon?.features || {};
-
-  if (flexibleScanExecutionPolicy) {
-    return isGroup
-      ? DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_OPTIMIZED
-      : DEFAULT_SCAN_EXECUTION_POLICY_OPTIMIZED;
-  }
-
   return isGroup ? DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE : DEFAULT_SCAN_EXECUTION_POLICY;
 };
 
diff --git a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component.vue b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component.vue
index c73089815234d9..4f98e78e432791 100644
--- a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component.vue
+++ b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component.vue
@@ -87,9 +87,6 @@ export default {
     pipelineSources() {
       return this.initRule.pipeline_sources || {};
     },
-    hasFlexibleScanExecutionPolicyFeatureFlag() {
-      return this.glFeatures.flexibleScanExecutionPolicy;
-    },
     rulesListBoxItems() {
       return Object.entries(this.$options.SCAN_EXECUTION_RULES_LABELS).map(([value, text]) => ({
         value,
@@ -118,18 +115,9 @@ export default {
         );
       }
 
-      // Handle flexible scan execution policy with target branches
-      const hasFlexiblePolicy = this.hasFlexibleScanExecutionPolicyFeatureFlag;
-
-      if (hasFlexiblePolicy) {
-        return s__(
-          'ScanExecutionPolicy|%{rules} every time a pipeline runs that %{scopes} %{branches} using %{sources} %{branchExceptions} %{agents} %{namespaces}',
-        );
-      }
-
       // Default pipeline rule
       return s__(
-        'ScanExecutionPolicy|%{rules} every time a pipeline runs for %{scopes} %{branches} %{branchExceptions} %{agents} %{namespaces}',
+        'ScanExecutionPolicy|%{rules} every time a pipeline runs that %{scopes} %{branches} using %{sources} %{branchExceptions} %{agents} %{namespaces}',
       );
     },
     showAllPipelineSources() {
diff --git a/ee/app/controllers/groups/security/policies_controller.rb b/ee/app/controllers/groups/security/policies_controller.rb
index 42bdb7feed30d6..af5af1d557b665 100644
--- a/ee/app/controllers/groups/security/policies_controller.rb
+++ b/ee/app/controllers/groups/security/policies_controller.rb
@@ -15,7 +15,6 @@ class PoliciesController < Groups::ApplicationController
         push_frontend_feature_flag(:security_policies_split_view, group)
         push_frontend_feature_flag(:security_policy_approval_warn_mode, group)
         push_frontend_feature_flag(:scheduled_pipeline_execution_policies, group)
-        push_frontend_feature_flag(:flexible_scan_execution_policy, group)
         push_frontend_feature_flag(:security_policies_combined_list, group)
         push_frontend_feature_flag(:security_policies_kev_filter, group)
       end
diff --git a/ee/app/controllers/projects/security/policies_controller.rb b/ee/app/controllers/projects/security/policies_controller.rb
index 1b0ae8eeb13ee1..e83544079f59b0 100644
--- a/ee/app/controllers/projects/security/policies_controller.rb
+++ b/ee/app/controllers/projects/security/policies_controller.rb
@@ -15,7 +15,6 @@ class PoliciesController < Projects::ApplicationController
         push_frontend_feature_flag(:scheduled_pipeline_execution_policies, project)
         push_frontend_feature_flag(:security_policies_split_view, project.group)
         push_frontend_feature_flag(:security_policy_approval_warn_mode, project.group)
-        push_frontend_feature_flag(:flexible_scan_execution_policy, project.group)
         push_frontend_feature_flag(:security_policies_combined_list, project)
         push_frontend_feature_flag(:security_policies_kev_filter, project.group)
       end
diff --git a/ee/spec/frontend/security_orchestration/components/policy_editor/constants_spec.js b/ee/spec/frontend/security_orchestration/components/policy_editor/constants_spec.js
index 1bef8388e7b287..2d56f05d004dac 100644
--- a/ee/spec/frontend/security_orchestration/components/policy_editor/constants_spec.js
+++ b/ee/spec/frontend/security_orchestration/components/policy_editor/constants_spec.js
@@ -12,96 +12,56 @@ import {
 } from 'ee/security_orchestration/components/policy_editor/constants';
 
 describe('SCAN_EXECUTION_BRANCH_TYPE_OPTIONS', () => {
-  afterEach(() => {
-    window.gon = { features: {} };
+  it('returns extended options for group namespace', () => {
+    expect(
+      SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({
+        namespaceType: NAMESPACE_TYPES.GROUP,
+        includeTargetTypes: true,
+      }),
+    ).toEqual([
+      ALL_BRANCHES,
+      GROUP_DEFAULT_BRANCHES,
+      ALL_PROTECTED_BRANCHES,
+      SPECIFIC_BRANCHES,
+      TARGET_PROTECTED_BRANCHES,
+      GROUP_TARGET_DEFAULT_BRANCHES,
+    ]);
   });
 
-  describe('with feature flag disabled', () => {
-    beforeEach(() => {
-      window.gon = { features: { flexibleScanExecutionPolicy: false } };
-    });
-
-    it('returns base options for group namespace', () => {
-      expect(SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({ namespaceType: NAMESPACE_TYPES.GROUP })).toEqual([
-        ALL_BRANCHES,
-        GROUP_DEFAULT_BRANCHES,
-        ALL_PROTECTED_BRANCHES,
-        SPECIFIC_BRANCHES,
-      ]);
-    });
-
-    it('returns base options for project namespace', () => {
-      expect(
-        SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({ namespaceType: NAMESPACE_TYPES.PROJECT }),
-      ).toEqual([ALL_BRANCHES, PROJECT_DEFAULT_BRANCH, ALL_PROTECTED_BRANCHES, SPECIFIC_BRANCHES]);
-    });
-
-    it('uses group namespace by default when namespace type is not provided', () => {
-      expect(SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({})).toEqual([
-        ALL_BRANCHES,
-        GROUP_DEFAULT_BRANCHES,
-        ALL_PROTECTED_BRANCHES,
-        SPECIFIC_BRANCHES,
-      ]);
-    });
+  it('returns extended options for project namespace', () => {
+    expect(
+      SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({
+        namespaceType: NAMESPACE_TYPES.PROJECT,
+        includeTargetTypes: true,
+      }),
+    ).toEqual([
+      ALL_BRANCHES,
+      PROJECT_DEFAULT_BRANCH,
+      ALL_PROTECTED_BRANCHES,
+      SPECIFIC_BRANCHES,
+      TARGET_PROTECTED_BRANCHES,
+      PROJECT_TARGET_DEFAULT_BRANCH,
+    ]);
   });
 
-  describe('with feature flag enabled', () => {
-    beforeEach(() => {
-      window.gon = { features: { flexibleScanExecutionPolicy: true } };
-    });
-
-    it('returns extended options for group namespace', () => {
-      expect(
-        SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({
-          namespaceType: NAMESPACE_TYPES.GROUP,
-          includeTargetTypes: true,
-        }),
-      ).toEqual([
-        ALL_BRANCHES,
-        GROUP_DEFAULT_BRANCHES,
-        ALL_PROTECTED_BRANCHES,
-        SPECIFIC_BRANCHES,
-        TARGET_PROTECTED_BRANCHES,
-        GROUP_TARGET_DEFAULT_BRANCHES,
-      ]);
-    });
-
-    it('returns extended options for project namespace', () => {
-      expect(
-        SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({
-          namespaceType: NAMESPACE_TYPES.PROJECT,
-          includeTargetTypes: true,
-        }),
-      ).toEqual([
-        ALL_BRANCHES,
-        PROJECT_DEFAULT_BRANCH,
-        ALL_PROTECTED_BRANCHES,
-        SPECIFIC_BRANCHES,
-        TARGET_PROTECTED_BRANCHES,
-        PROJECT_TARGET_DEFAULT_BRANCH,
-      ]);
-    });
-
-    it('uses group namespace by default when namespace type is not provided', () => {
-      expect(SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({ includeTargetTypes: true })).toEqual([
-        ALL_BRANCHES,
-        GROUP_DEFAULT_BRANCHES,
-        ALL_PROTECTED_BRANCHES,
-        SPECIFIC_BRANCHES,
-        TARGET_PROTECTED_BRANCHES,
-        GROUP_TARGET_DEFAULT_BRANCHES,
-      ]);
-    });
+  it('uses group namespace by default when namespace type is not provided', () => {
+    expect(SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({ includeTargetTypes: true })).toEqual([
+      ALL_BRANCHES,
+      GROUP_DEFAULT_BRANCHES,
+      ALL_PROTECTED_BRANCHES,
+      SPECIFIC_BRANCHES,
+      TARGET_PROTECTED_BRANCHES,
+      GROUP_TARGET_DEFAULT_BRANCHES,
+    ]);
+  });
 
-    it('does not return target types if not specified', () => {
-      expect(SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({ namespaceType: NAMESPACE_TYPES.GROUP })).toEqual([
-        ALL_BRANCHES,
-        GROUP_DEFAULT_BRANCHES,
-        ALL_PROTECTED_BRANCHES,
-        SPECIFIC_BRANCHES,
-      ]);
-    });
+  it('does not return target types if not specified', () => {
+    expect(SCAN_EXECUTION_BRANCH_TYPE_OPTIONS({ namespaceType: NAMESPACE_TYPES.GROUP })).toEqual([
+      ALL_BRANCHES,
+      GROUP_DEFAULT_BRANCHES,
+      ALL_PROTECTED_BRANCHES,
+      SPECIFIC_BRANCHES,
+    ]);
   });
 
   it('uses empty feature flags object by default when not provided', () => {
diff --git a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js
index e977b1dffb2e93..ecfade985fa7a6 100644
--- a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js
+++ b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js
@@ -18,10 +18,9 @@ import {
   ASSIGNED_POLICY_PROJECT,
 } from 'ee_jest/security_orchestration/mocks/mock_data';
 import {
-  DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE,
   buildScannerAction,
   buildDefaultScheduleRule,
-  DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_WITH_DEFAULT_VARIABLES,
+  DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE,
 } from 'ee/security_orchestration/components/policy_editor/scan_execution/lib';
 import {
   DEFAULT_ASSIGNED_POLICY_PROJECT,
@@ -33,14 +32,14 @@ import {
   mockInvalidActionScanExecutionObject,
   mockInvalidRuleScanExecutionObject,
   mockScheduledTemplateScanExecutionObject,
+  mockScanExecutionWithDefaultVariablesManifest,
+  mockCustomScanExecutionObject,
 } from 'ee_jest/security_orchestration/mocks/mock_scan_execution_policy_data';
 
 import {
   ACTION_SECTION_DISABLE_ERROR,
   CONDITION_SECTION_DISABLE_ERROR,
   SECURITY_POLICY_ACTIONS,
-  EDITOR_MODE_RULE,
-  EDITOR_MODE_YAML,
 } from 'ee/security_orchestration/components/policy_editor/constants';
 import {
   DEFAULT_CONDITION_STRATEGY,
@@ -161,27 +160,53 @@ describe('EditorComponent', () => {
     beforeEach(() => {
       factory();
     });
+
     describe('scope', () => {
       it.each`
-        namespaceType              | manifest
+        namespaceType              | expected
         ${NAMESPACE_TYPES.GROUP}   | ${SCAN_EXECUTION_DEFAULT_POLICY_WITH_SCOPE}
         ${NAMESPACE_TYPES.PROJECT} | ${SCAN_EXECUTION_DEFAULT_POLICY}
-      `('should render default policy for a $namespaceType', ({ namespaceType, manifest }) => {
+      `('renders default policy for a $namespaceType', ({ namespaceType, expected }) => {
         factory({ provide: { namespaceType } });
 
-        expect(findPolicyEditorLayout().props('policy')).toEqual(manifest);
+        expect(findPolicyEditorLayout().props('policy')).toEqual(expected);
         expect(findSkipCiSelector().exists()).toBe(true);
       });
     });
 
-    it('should render correctly', () => {
-      expect(findDisabledAction().props()).toEqual({
-        disabled: false,
-        error: ACTION_SECTION_DISABLE_ERROR,
+    describe('policy', () => {
+      it('renders default and custom selections', () => {
+        factory();
+        expect(findConfigurationSelection().exists()).toBe(true);
       });
-      expect(findDisabledRule().props()).toEqual({
-        disabled: false,
-        error: CONDITION_SECTION_DISABLE_ERROR,
+
+      it('renders optimized scanner by default', () => {
+        factory();
+        expect(findActionBuilderDefaultConfigRadioButton().props('checked')).toBe('default');
+        expect(findActionBuilderDefaultConfigRadioButton().attributes().disabled).toBe(undefined);
+      });
+
+      it('does not show custom configuration section', () => {
+        factory();
+        expect(findActionBuilderDefaultConfig().exists()).toBe(true);
+        expect(findActionBuilderCustomConfig().exists()).toBe(false);
+      });
+
+      it('disables default configuration when the policy is incompatible', async () => {
+        factory();
+
+        // Switch to custom config first
+        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+
+        // Add a DAST scan action, but there are many reasons the policy may be invalid for
+        // optimized scans. See the getConfiguration method in
+        // ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/lib/index.js
+        // for more info
+        const dastAction = { scan: 'dast' };
+        findActionBuilder().vm.$emit('changed', dastAction);
+        await nextTick();
+
+        expect(findActionBuilderDefaultConfigRadioButton().attributes().disabled).toBe('true');
       });
     });
   });
@@ -189,7 +214,7 @@ describe('EditorComponent', () => {
   describe('modifying a policy', () => {
     it.each`
       status                           | action                            | event              | factoryFn                    | yamlEditorValue
-      ${'creating a new policy'}       | ${undefined}                      | ${'save-policy'}   | ${factory}                   | ${policyBodyToYaml(fromYaml({ manifest: DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_WITH_DEFAULT_VARIABLES, type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter }))}
+      ${'creating a new policy'}       | ${undefined}                      | ${'save-policy'}   | ${factory}                   | ${policyBodyToYaml(fromYaml({ manifest: mockScanExecutionWithDefaultVariablesManifest, type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter }))}
       ${'updating an existing policy'} | ${undefined}                      | ${'save-policy'}   | ${factoryWithExistingPolicy} | ${mockDastScanExecutionManifest}
       ${'deleting an existing policy'} | ${SECURITY_POLICY_ACTIONS.REMOVE} | ${'remove-policy'} | ${factoryWithExistingPolicy} | ${mockDastScanExecutionManifest}
     `('emits "save" when $status', async ({ action, event, factoryFn, yamlEditorValue }) => {
@@ -225,7 +250,7 @@ enabled: true`;
           manifest: DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE,
           type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
         }),
-        yamlEditorValue: DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_WITH_DEFAULT_VARIABLES,
+        yamlEditorValue: mockScanExecutionWithDefaultVariablesManifest,
       });
       findPolicyEditorLayout().vm.$emit('update-yaml', newManifest);
       await nextTick();
@@ -281,163 +306,134 @@ enabled: true`;
       uniqueId.mockRestore();
     });
 
-    it('should add new rule', async () => {
-      factory();
+    describe('default configuration', () => {
+      describe('rule strategy selector', () => {
+        it('updates the rules when a change is emitted', async () => {
+          const rules = [{ branch_type: 'all' }];
+          factory();
+          expect(findRuleStrategySelector().props('strategy')).toBe(DEFAULT_CONDITION_STRATEGY);
+          await findRuleStrategySelector().vm.$emit('changed', {
+            strategy: 'any',
+            rules,
+          });
+          expect(findRuleStrategySelector().props('strategy')).toBe('any');
+          expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(rules);
+        });
 
-      const initialValue = [RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE]()];
-      expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(initialValue);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).rules,
-      ).toStrictEqual(initialValue);
-      expect(findAllRuleSections()).toHaveLength(1);
+        it('selects the pre-defined strategy for an existing policy', () => {
+          factoryWithExistingPolicy({ policy: mockScheduledTemplateScanExecutionObject });
+          expect(findRuleStrategySelector().props('strategy')).toBe('scheduled');
+        });
+      });
+    });
 
-      findAddRuleButton().vm.$emit('click');
-      await nextTick();
+    describe('custom configuration', () => {
+      it('should add new rule', async () => {
+        factory();
+        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
 
-      const finalValue = [
-        RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](),
-        RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](),
-      ];
-      expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(finalValue);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).rules,
-      ).toStrictEqual(finalValue);
-      expect(findAllRuleSections()).toHaveLength(2);
-    });
+        const initialValue = [RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE]()];
+        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(initialValue);
+        expect(
+          fromYaml({
+            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
+            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
+          }).rules,
+        ).toStrictEqual(initialValue);
+        expect(findAllRuleSections()).toHaveLength(1);
 
-    it('should add a new rule if the rule property does not exist', async () => {
-      factory({ propsData: { existingPolicy: { name: 'test' }, isEditing: true } });
-      expect(findAllRuleSections()).toHaveLength(0);
-      findAddRuleButton().vm.$emit('click');
-      await nextTick();
-      expect(findAllRuleSections()).toHaveLength(1);
-    });
+        findAddRuleButton().vm.$emit('click');
+        await nextTick();
 
-    it('should update rule', async () => {
-      factory();
-      const initialValue = [RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE]()];
-      expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(initialValue);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).rules,
-      ).toStrictEqual(initialValue);
+        const finalValue = [
+          RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](),
+          RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](),
+        ];
+        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(finalValue);
+        expect(
+          fromYaml({
+            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
+            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
+          }).rules,
+        ).toStrictEqual(finalValue);
+        expect(findAllRuleSections()).toHaveLength(2);
+      });
 
-      const finalValue = [{ ...RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](), branches: ['main'] }];
-      findRuleSection().vm.$emit('changed', finalValue[0]);
-      await nextTick();
+      it('should add a new rule if the rule property does not exist', async () => {
+        factory({ propsData: { existingPolicy: { name: 'test' }, isEditing: true } });
+        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+        expect(findAllRuleSections()).toHaveLength(0);
+        findAddRuleButton().vm.$emit('click');
+        await nextTick();
+        expect(findAllRuleSections()).toHaveLength(1);
+      });
 
-      expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(finalValue);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).rules,
-      ).toStrictEqual(finalValue);
-    });
+      it('should update rule', async () => {
+        factory();
+        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+        const initialValue = [RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE]()];
+        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(initialValue);
+        expect(
+          fromYaml({
+            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
+            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
+          }).rules,
+        ).toStrictEqual(initialValue);
 
-    it('should remove rule', async () => {
-      factory();
-      findAddRuleButton().vm.$emit('click');
-      await nextTick();
+        const finalValue = [
+          { ...RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](), branches: ['main'] },
+        ];
+        findRuleSection().vm.$emit('changed', finalValue[0]);
+        await nextTick();
 
-      expect(findAllRuleSections()).toHaveLength(2);
-      expect(findPolicyEditorLayout().props('policy').rules).toHaveLength(2);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).rules,
-      ).toHaveLength(2);
+        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(finalValue);
+        expect(
+          fromYaml({
+            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
+            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
+          }).rules,
+        ).toStrictEqual(finalValue);
+      });
 
-      findRuleSection().vm.$emit('remove', 1);
-      await nextTick();
+      it('should remove rule', async () => {
+        factory();
+        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+        findAddRuleButton().vm.$emit('click');
+        await nextTick();
 
-      expect(findAllRuleSections()).toHaveLength(1);
-      expect(findPolicyEditorLayout().props('policy').rules).toHaveLength(1);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).rules,
-      ).toHaveLength(1);
+        expect(findAllRuleSections()).toHaveLength(2);
+        expect(findPolicyEditorLayout().props('policy').rules).toHaveLength(2);
+        expect(
+          fromYaml({
+            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
+            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
+          }).rules,
+        ).toHaveLength(2);
+
+        findRuleSection().vm.$emit('remove', 1);
+        await nextTick();
+
+        expect(findAllRuleSections()).toHaveLength(1);
+        expect(findPolicyEditorLayout().props('policy').rules).toHaveLength(1);
+        expect(
+          fromYaml({
+            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
+            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
+          }).rules,
+        ).toHaveLength(1);
+      });
     });
   });
 
   describe('action builder', () => {
-    const glFeatures = { flexibleScanExecutionPolicy: true };
-
     beforeEach(() => {
       uniqueId.mockRestore();
-      window.gon = { features: glFeatures };
-    });
-
-    afterAll(() => {
-      window.gon = { features: {} };
-    });
-
-    describe('default', () => {
-      it('shows default and custom selections', () => {
-        factory({
-          provide: { glFeatures },
-        });
-        expect(findConfigurationSelection().exists()).toBe(true);
-      });
-
-      it('checks optimized scanner by default', () => {
-        factory({
-          provide: { glFeatures },
-        });
-        expect(findActionBuilderDefaultConfigRadioButton().props('checked')).toBe('default');
-        expect(findActionBuilderDefaultConfigRadioButton().attributes().disabled).toBe(undefined);
-      });
     });
 
     describe('default configuration', () => {
-      it('does not show custom configuration section', () => {
-        factory({
-          provide: { glFeatures },
-        });
-        expect(findActionBuilderDefaultConfig().exists()).toBe(true);
-        expect(findActionBuilderCustomConfig().exists()).toBe(false);
-      });
-
-      describe('rule strategy selector', () => {
-        it('updates the rules when a change is emitted', async () => {
-          const rules = [{ branch_type: 'all' }];
-          factory({
-            provide: { glFeatures },
-          });
-          expect(findRuleStrategySelector().props('strategy')).toBe(DEFAULT_CONDITION_STRATEGY);
-          await findRuleStrategySelector().vm.$emit('changed', {
-            strategy: 'any',
-            rules,
-          });
-          expect(findRuleStrategySelector().props('strategy')).toBe('any');
-          expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(rules);
-        });
-
-        it('selects the pre-defined strategy for an existing policy', () => {
-          factoryWithExistingPolicy({
-            provide: { glFeatures },
-            policy: mockScheduledTemplateScanExecutionObject,
-          });
-          expect(findRuleStrategySelector().props('strategy')).toBe('scheduled');
-        });
-      });
-
       describe('optimized scan selector', () => {
         it('renders optimized scan selector', () => {
-          factory({
-            provide: { glFeatures },
-          });
+          factory();
           expect(findOptimizedScanSelector().exists()).toBe(true);
           expect(findOptimizedScanSelector().props()).toEqual({
             disabled: false,
@@ -446,9 +442,7 @@ enabled: true`;
         });
 
         it('adds new action when selected', async () => {
-          factory({
-            provide: { glFeatures },
-          });
+          factory();
           await findOptimizedScanSelector().vm.$emit('change', {
             scanner: 'sast',
             enabled: true,
@@ -471,9 +465,7 @@ enabled: true`;
         });
 
         it('removes action when deselected', async () => {
-          factory({
-            provide: { glFeatures },
-          });
+          factory();
           await findOptimizedScanSelector().vm.$emit('change', {
             scanner: 'secret_detection',
             enabled: false,
@@ -486,29 +478,6 @@ enabled: true`;
             }).actions,
           ).toStrictEqual([]);
         });
-
-        it('is disabled when the policy is incompatible', async () => {
-          factory({
-            provide: { glFeatures },
-          });
-
-          // Switch to custom config first
-          await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
-
-          // Add a DAST scan action, but there are many reasons the policy may be invalid for
-          // optimized scans. See the getConfiguration method in
-          // ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/lib/index.js
-          // for more info
-          const dastAction = { scan: 'dast' };
-          findActionBuilder().vm.$emit('changed', dastAction);
-          await nextTick();
-
-          // Switch to YAML mode and back to rule mode to trigger recalculation
-          await findPolicyEditorLayout().vm.$emit('editor-mode-changed', EDITOR_MODE_YAML);
-          await findPolicyEditorLayout().vm.$emit('editor-mode-changed', EDITOR_MODE_RULE);
-
-          expect(findActionBuilderDefaultConfigRadioButton().attributes().disabled).toBe('true');
-        });
       });
     });
 
@@ -521,16 +490,14 @@ enabled: true`;
         },
       ];
       it('does not show default configuration section', async () => {
-        factory({
-          provide: { glFeatures },
-        });
+        factory();
         await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
         expect(findActionBuilderDefaultConfig().exists()).toBe(false);
         expect(findActionBuilderCustomConfig().exists()).toBe(true);
       });
 
       it('adds new action', async () => {
-        factory({ provide: { glFeatures } });
+        factory();
         await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
 
         expect(findPolicyEditorLayout().props('policy').actions).toEqual(
@@ -567,7 +534,6 @@ enabled: true`;
       it('adds a new action if the action property does not exist', async () => {
         factory({
           propsData: { existingPolicy: { name: 'test' }, isEditing: true },
-          provide: { glFeatures },
         });
         await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
 
@@ -581,7 +547,7 @@ enabled: true`;
       });
 
       it('updates action', async () => {
-        factory({ provide: { glFeatures } });
+        factory();
         await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
 
         const initialValue = [
@@ -617,7 +583,7 @@ enabled: true`;
       });
 
       it('removes action', async () => {
-        factory({ provide: { glFeatures } });
+        factory();
         await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
         findAddActionButton().vm.$emit('click');
         await nextTick();
@@ -646,12 +612,7 @@ enabled: true`;
 
       it('limits number of actions', async () => {
         const MAX_ACTIONS = 3;
-        factory({
-          provide: {
-            maxScanExecutionPolicyActions: MAX_ACTIONS,
-            glFeatures,
-          },
-        });
+        factory({ provide: { maxScanExecutionPolicyActions: MAX_ACTIONS } });
         await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
 
         expect(findAddActionButton().attributes().disabled).toBeUndefined();
@@ -670,130 +631,6 @@ enabled: true`;
     });
   });
 
-  describe('action builder without flexibleScanExecutionPolicy feature flag', () => {
-    beforeEach(() => {
-      uniqueId.mockRestore();
-    });
-
-    it('does not show configuration selection', () => {
-      factory();
-      expect(findConfigurationSelection().exists()).toBe(false);
-    });
-
-    it('should add new action', async () => {
-      factory();
-      const initialValue = [
-        buildScannerAction({ scanner: DEFAULT_SCANNER, withDefaultVariables: true }),
-      ];
-      expect(findPolicyEditorLayout().props('policy').actions).toStrictEqual(initialValue);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).actions,
-      ).toStrictEqual(initialValue);
-
-      findAddActionButton().vm.$emit('click');
-      await nextTick();
-
-      const finalValue = [
-        buildScannerAction({ scanner: DEFAULT_SCANNER, withDefaultVariables: true }),
-        buildScannerAction({ scanner: DEFAULT_SCANNER, withDefaultVariables: true }),
-      ];
-
-      expect(findPolicyEditorLayout().props('policy').actions).toStrictEqual(finalValue);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).actions,
-      ).toStrictEqual(finalValue);
-    });
-
-    it('should add a new action if the action property does not exist', async () => {
-      factory({ propsData: { existingPolicy: { name: 'test' }, isEditing: true } });
-      expect(findAllActionBuilders()).toHaveLength(0);
-      findAddActionButton().vm.$emit('click');
-      await nextTick();
-      expect(findAddActionButtonWrapper().attributes('title')).toBe('');
-      expect(findAllActionBuilders()).toHaveLength(1);
-    });
-
-    it('should update action', async () => {
-      factory();
-      const initialValue = [
-        buildScannerAction({ scanner: DEFAULT_SCANNER, withDefaultVariables: true }),
-      ];
-      expect(findPolicyEditorLayout().props('policy').actions).toStrictEqual(initialValue);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).actions,
-      ).toStrictEqual(initialValue);
-
-      const finalValue = [buildScannerAction({ scanner: 'sast', withDefaultVariables: true })];
-      findActionBuilder().vm.$emit('changed', finalValue[0]);
-      await nextTick();
-
-      expect(findPolicyEditorLayout().props('policy').actions).toStrictEqual(finalValue);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).actions,
-      ).toStrictEqual(finalValue);
-    });
-
-    it('should remove action', async () => {
-      factory();
-      findAddActionButton().vm.$emit('click');
-      await nextTick();
-
-      expect(findAllActionBuilders()).toHaveLength(2);
-      expect(findPolicyEditorLayout().props('policy').actions).toHaveLength(2);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).actions,
-      ).toHaveLength(2);
-
-      findActionBuilder().vm.$emit('remove', 1);
-      await nextTick();
-
-      expect(findAllActionBuilders()).toHaveLength(1);
-      expect(findPolicyEditorLayout().props('policy').actions).toHaveLength(1);
-      expect(
-        fromYaml({
-          manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }).actions,
-      ).toHaveLength(1);
-    });
-
-    it('should limit number of actions', async () => {
-      factory({
-        provide: {
-          maxScanExecutionPolicyActions: 3,
-        },
-      });
-
-      expect(findAddActionButton().attributes().disabled).toBeUndefined();
-      expect(findAllActionBuilders()).toHaveLength(1);
-
-      await findAddActionButton().vm.$emit('click');
-      await findAddActionButton().vm.$emit('click');
-      await findAddActionButton().vm.$emit('click');
-
-      expect(findAddActionButton().attributes().disabled).toBe('true');
-      expect(findAddActionButtonWrapper().attributes('title')).toBe(
-        'Policy has reached the maximum of 3 actions',
-      );
-      expect(findAllActionBuilders()).toHaveLength(3);
-    });
-  });
-
   describe('parsing errors', () => {
     it.each`
       name               | errorKey                                         | error
@@ -1036,33 +873,24 @@ enabled: true`;
     });
 
     it('renders existing default skip ci configuration when it is removed from yaml', async () => {
-      factoryWithExistingPolicy({
-        policy: {
-          skip_ci: skipCi,
-        },
-      });
+      factoryWithExistingPolicy({ policy: { skip_ci: skipCi } });
 
       expect(findSkipCiSelector().props('skipCiConfiguration')).toEqual(skipCi);
       await findPolicyEditorLayout().vm.$emit('update-yaml', mockDastScanExecutionManifest);
-
-      expect(findSkipCiSelector().findComponent(GlToggle).props('value')).toBe(
-        !DEFAULT_SKIP_SI_CONFIGURATION.allowed,
-      );
+      expect(findSkipCiSelector().props('skipCiConfiguration')).toBe(undefined);
     });
   });
 
   describe('new yaml format with type as a wrapper', () => {
-    beforeEach(() => {
-      factory();
-    });
-
     it('renders default yaml in new format', () => {
+      factoryWithExistingPolicy({ policy: mockCustomScanExecutionObject });
       expect(findPolicyEditorLayout().props('yamlEditorValue')).toBe(
-        DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_WITH_DEFAULT_VARIABLES,
+        mockScanExecutionWithDefaultVariablesManifest,
       );
     });
 
     it('converts new policy format to old policy format when saved', async () => {
+      factory();
       findPolicyEditorLayout().vm.$emit('save-policy');
       await waitForPromises();
 
@@ -1078,10 +906,15 @@ policy_scope:
     excluding: []
 rules:
   - type: pipeline
-    branches:
-      - '*'
+    branch_type: default
+  - type: pipeline
+    branch_type: target_default
+    pipeline_sources:
+      including:
+        - merge_request_event
 actions:
   - scan: secret_detection
+    template: latest
     variables:
       SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
 skip_ci:
diff --git a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/actions_spec.js b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/actions_spec.js
index b6b56b5e1879b2..42da8d7ccca62c 100644
--- a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/actions_spec.js
+++ b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/actions_spec.js
@@ -14,9 +14,9 @@ import {
   REPORT_TYPE_API_FUZZING,
 } from '~/vue_shared/security_reports/constants';
 import {
-  DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE,
-  DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_WITH_DEFAULT_VARIABLES,
-} from 'ee/security_orchestration/components/policy_editor/scan_execution/lib';
+  mockCustomScanExecutionManifest,
+  mockScanExecutionWithDefaultVariablesManifest,
+} from 'ee_jest/security_orchestration/mocks/mock_scan_execution_policy_data';
 
 const actionId = 'action_0';
 jest.mock('lodash/uniqueId', () => jest.fn().mockReturnValue(actionId));
@@ -93,8 +93,10 @@ describe('addDefaultVariablesToPolicy', () => {
 describe('addDefaultVariablesToManifest', () => {
   it('adds default variable to a policy manifest with specific scanners', () => {
     expect(
-      addDefaultVariablesToManifest({ manifest: DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE }),
-    ).toBe(DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_WITH_DEFAULT_VARIABLES);
+      addDefaultVariablesToManifest({
+        manifest: mockCustomScanExecutionManifest,
+      }),
+    ).toBe(mockScanExecutionWithDefaultVariablesManifest);
   });
 });
 
diff --git a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/index_spec.js b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/index_spec.js
index 1d81c96a340463..5715d31c7e3c3a 100644
--- a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/index_spec.js
+++ b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/index_spec.js
@@ -2,8 +2,6 @@ import { REPORT_TYPE_DAST } from '~/vue_shared/security_reports/constants';
 import {
   DEFAULT_SCAN_EXECUTION_POLICY,
   DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE,
-  DEFAULT_SCAN_EXECUTION_POLICY_OPTIMIZED,
-  DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_OPTIMIZED,
   STRATEGIES_RULE_MAP,
   getPolicyYaml,
   getConfiguration,
@@ -17,43 +15,12 @@ import {
 } from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
 
 describe('getPolicyYaml', () => {
-  let originalGon;
-
-  beforeEach(() => {
-    originalGon = window.gon;
-    window.gon = { features: {} };
-  });
-
-  afterEach(() => {
-    window.gon = originalGon;
-  });
-
-  describe('with feature flag disabled', () => {
-    beforeEach(() => {
-      window.gon.features = { flexibleScanExecutionPolicy: false };
-    });
-
-    it.each`
-      namespaceType              | expected
-      ${NAMESPACE_TYPES.PROJECT} | ${DEFAULT_SCAN_EXECUTION_POLICY}
-      ${NAMESPACE_TYPES.GROUP}   | ${DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE}
-    `('returns the standard yaml for $namespaceType namespace', ({ namespaceType, expected }) => {
-      expect(getPolicyYaml({ isGroup: isGroup(namespaceType) })).toEqual(expected);
-    });
-  });
-
-  describe('with feature flag enabled', () => {
-    beforeEach(() => {
-      window.gon.features = { flexibleScanExecutionPolicy: true };
-    });
-
-    it.each`
-      namespaceType              | expected
-      ${NAMESPACE_TYPES.PROJECT} | ${DEFAULT_SCAN_EXECUTION_POLICY_OPTIMIZED}
-      ${NAMESPACE_TYPES.GROUP}   | ${DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE_OPTIMIZED}
-    `('returns the optimized yaml for $namespaceType namespace', ({ namespaceType, expected }) => {
-      expect(getPolicyYaml({ isGroup: isGroup(namespaceType) })).toEqual(expected);
-    });
+  it.each`
+    namespaceType              | expected
+    ${NAMESPACE_TYPES.PROJECT} | ${DEFAULT_SCAN_EXECUTION_POLICY}
+    ${NAMESPACE_TYPES.GROUP}   | ${DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE}
+  `('returns the optimized yaml for $namespaceType namespace', ({ namespaceType, expected }) => {
+    expect(getPolicyYaml({ isGroup: isGroup(namespaceType) })).toEqual(expected);
   });
 });
 
diff --git a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component_spec.js b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component_spec.js
index 263f608395d73d..72bef7a4ec0cb6 100644
--- a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component_spec.js
+++ b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component_spec.js
@@ -294,7 +294,6 @@ describe('BaseRuleComponent', () => {
               branch_type: ALL_PROTECTED_BRANCHES,
             },
           },
-          provide: { glFeatures: { flexibleScanExecutionPolicy: true } },
         });
 
         expect(findPipelineSourceSelector().exists()).toBe(true);
@@ -312,7 +311,6 @@ describe('BaseRuleComponent', () => {
               branch_type: TARGET_DEFAULT,
             },
           },
-          provide: { glFeatures: { flexibleScanExecutionPolicy: true } },
         });
 
         expect(findPipelineSourceSelector().exists()).toBe(true);
@@ -332,7 +330,6 @@ describe('BaseRuleComponent', () => {
               branch_type: TARGET_DEFAULT,
             },
           },
-          provide: { glFeatures: { flexibleScanExecutionPolicy: true } },
         });
         const pipelineSources = { pipeline_sources: { including: ['web', 'api'] } };
         await findPipelineSourceSelector().vm.$emit('select', pipelineSources);
@@ -350,27 +347,10 @@ describe('BaseRuleComponent', () => {
           props: {
             initRule: { ...pipelineRule, pipeline_sources: { including: ['api'] } },
           },
-          provide: { glFeatures: { flexibleScanExecutionPolicy: true } },
         });
         findPipelineSourceSelector().vm.$emit('remove');
         expect(wrapper.emitted('changed')).toEqual([[{ ...pipelineRule }]]);
       });
     });
-
-    describe('with feature flag disabled', () => {
-      it('does not show when feature flag is disabled', () => {
-        createComponent({
-          props: {
-            initRule: {
-              type: SCAN_EXECUTION_RULES_PIPELINE_KEY,
-              branch_type: TARGET_DEFAULT,
-            },
-          },
-          provide: { glFeatures: { flexibleScanExecutionPolicy: false } },
-        });
-
-        expect(findPipelineSourceSelector().exists()).toBe(false);
-      });
-    });
   });
 });
diff --git a/ee/spec/frontend/security_orchestration/mocks/mock_data.js b/ee/spec/frontend/security_orchestration/mocks/mock_data.js
index f6f0571ef7e3ab..acc2213d79f82c 100644
--- a/ee/spec/frontend/security_orchestration/mocks/mock_data.js
+++ b/ee/spec/frontend/security_orchestration/mocks/mock_data.js
@@ -95,11 +95,20 @@ export const SCAN_EXECUTION_DEFAULT_POLICY = {
   name: '',
   description: '',
   enabled: true,
-  rules: [{ type: 'pipeline', branches: ['*'], id: 'rule_0' }],
+  rules: [
+    { type: 'pipeline', branch_type: 'default', id: 'rule_0' },
+    {
+      id: 'rule_0',
+      type: 'pipeline',
+      branch_type: 'target_default',
+      pipeline_sources: { including: ['merge_request_event'] },
+    },
+  ],
   actions: [
     {
-      scan: 'secret_detection',
       id: 'action_0',
+      scan: 'secret_detection',
+      template: 'latest',
       variables: { SECURE_ENABLE_LOCAL_CONFIGURATION: 'false' },
     },
   ],
diff --git a/ee/spec/frontend/security_orchestration/mocks/mock_scan_execution_policy_data.js b/ee/spec/frontend/security_orchestration/mocks/mock_scan_execution_policy_data.js
index 69b53058d51675..14f859a9ea593d 100644
--- a/ee/spec/frontend/security_orchestration/mocks/mock_scan_execution_policy_data.js
+++ b/ee/spec/frontend/security_orchestration/mocks/mock_scan_execution_policy_data.js
@@ -57,6 +57,46 @@ export const mockScanExecutionWithConfigurationManifest = `scan_execution_policy
       allowed: true
 `;
 
+export const mockCustomScanExecutionManifest = `scan_execution_policy:
+  - name: ''
+    description: ''
+    enabled: true
+    rules:
+      - type: pipeline
+        branches:
+          - '*'
+    actions:
+      - scan: secret_detection
+    skip_ci:
+      allowed: true
+`;
+
+export const mockCustomScanExecutionObject = {
+  type: 'scan_execution_policy',
+  name: '',
+  description: '',
+  enabled: true,
+  rules: [{ type: 'pipeline', branches: ['*'] }],
+  actions: [{ scan: 'secret_detection' }],
+  skip_ci: { allowed: true },
+};
+
+export const mockScanExecutionWithDefaultVariablesManifest = `scan_execution_policy:
+  - name: ''
+    description: ''
+    enabled: true
+    rules:
+      - type: pipeline
+        branches:
+          - '*'
+    actions:
+      - scan: secret_detection
+        variables:
+          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
+    skip_ci:
+      allowed: true
+`;
+
 export const mockScheduleScanExecutionManifest = defaultMockScanExecutionManifest.concat(`
 rules:
   - type: schedule
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index aa2db6b47eb7d1..cbc0725b9faf0a 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -57026,9 +57026,6 @@ msgstr ""
 msgid "ScanExecutionPolicy|%{rules} actions for %{scopes} %{branches} %{agents} %{branchExceptions} %{namespaces} %{period}"
 msgstr ""
 
-msgid "ScanExecutionPolicy|%{rules} every time a pipeline runs for %{scopes} %{branches} %{branchExceptions} %{agents} %{namespaces}"
-msgstr ""
-
 msgid "ScanExecutionPolicy|%{rules} every time a pipeline runs that %{scopes} %{branches} using %{sources} %{branchExceptions} %{agents} %{namespaces}"
 msgstr ""
 
-- 
GitLab


From 6f77f5ef87deb154aad9c99f1e328a177b021f6d Mon Sep 17 00:00:00 2001
From: Alexander Turinske <aturinske@gitlab.com>
Date: Mon, 22 Sep 2025 09:16:58 -0600
Subject: [PATCH 2/4] Update radio buttons

- use standard format
- update tests
---
 .../scan_execution/editor_component.vue       |  43 ++--
 .../scan_execution/editor_component_spec.js   | 215 ++++++++----------
 .../scan_execution/lib/actions_spec.js        |   4 +-
 .../components/utils_spec.js                  |  11 +-
 .../security_orchestration/mocks/mock_data.js |  18 +-
 .../mocks/mock_scan_execution_policy_data.js  |  26 ++-
 6 files changed, 158 insertions(+), 159 deletions(-)

diff --git a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue
index 22e0a4e9739630..2522251c6e0f01 100644
--- a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue
+++ b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue
@@ -2,7 +2,7 @@
 import {
   GlButton,
   GlEmptyState,
-  GlFormRadio,
+  GlFormRadioGroup,
   GlIcon,
   GlLink,
   GlSprintf,
@@ -116,7 +116,7 @@ export default {
     EditorLayout,
     GlButton,
     GlEmptyState,
-    GlFormRadio,
+    GlFormRadioGroup,
     GlIcon,
     GlLink,
     GlSprintf,
@@ -244,6 +244,20 @@ export default {
     isValidOptimizedPolicy() {
       return getConfiguration(this.policy) === SELECTION_CONFIG_DEFAULT;
     },
+    configurationOptions() {
+      return [
+        {
+          value: SELECTION_CONFIG_DEFAULT,
+          disabled: !this.isValidOptimizedPolicy,
+          text: s__('SecurityOrchestration|Template'),
+        },
+        {
+          value: SELECTION_CONFIG_CUSTOM,
+          disabled: !this.isValidOptimizedPolicy,
+          text: s__('SecurityOrchestration|Custom'),
+        },
+      ];
+    },
   },
   methods: {
     areManifestsEqual(manifest) {
@@ -341,6 +355,9 @@ export default {
 
       this.$emit('save', { action, policy: policyBodyToYaml(policy) });
     },
+    updateConfigType(value) {
+      this.configType = value;
+    },
     updateOptimizedAction({ enabled, scanner }) {
       if (enabled) {
         this.addAction({ scanner, isOptimized: true });
@@ -408,23 +425,11 @@ export default {
         </div>
         <div data-testid="configuration-selection">
           <h5>{{ s__('SecurityOrchestration|Configuration type') }}</h5>
-          <gl-form-radio
-            v-model="configType"
-            :value="$options.SELECTION_CONFIG_DEFAULT"
-            :disabled="!isValidOptimizedPolicy"
-            class="gl-mt-3"
-            data-testid="default-action-config-radio-button"
-          >
-            {{ s__('SecurityOrchestration|Template') }}
-          </gl-form-radio>
-          <gl-form-radio
-            v-model="configType"
-            :value="$options.SELECTION_CONFIG_CUSTOM"
-            class="gl-mb-0"
-            data-testid="custom-action-config-radio-button"
-          >
-            {{ s__('SecurityOrchestration|Custom') }}
-          </gl-form-radio>
+          <gl-form-radio-group
+            :checked="configType"
+            :options="configurationOptions"
+            @input="updateConfigType"
+          />
         </div>
         <section-layout class="gl-pt-0" :show-remove-button="false">
           <template #content>
diff --git a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js
index ecfade985fa7a6..07507e8edfbadd 100644
--- a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js
+++ b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js
@@ -1,6 +1,6 @@
-import Vue, { nextTick } from 'vue';
+import Vue from 'vue';
 import VueApollo from 'vue-apollo';
-import { GlEmptyState, GlToggle } from '@gitlab/ui';
+import { GlEmptyState, GlFormRadioGroup, GlToggle } from '@gitlab/ui';
 import { uniqueId } from 'lodash';
 import EditorComponent from 'ee/security_orchestration/components/policy_editor/scan_execution/editor_component.vue';
 import RuleSection from 'ee/security_orchestration/components/policy_editor/scan_execution/rule/rule_section.vue';
@@ -20,12 +20,9 @@ import {
 import {
   buildScannerAction,
   buildDefaultScheduleRule,
-  DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE,
 } from 'ee/security_orchestration/components/policy_editor/scan_execution/lib';
-import {
-  DEFAULT_ASSIGNED_POLICY_PROJECT,
-  NAMESPACE_TYPES,
-} from 'ee/security_orchestration/constants';
+
+import { NAMESPACE_TYPES } from 'ee/security_orchestration/constants';
 import {
   mockDastScanExecutionManifest,
   mockDastScanExecutionObject,
@@ -33,6 +30,7 @@ import {
   mockInvalidRuleScanExecutionObject,
   mockScheduledTemplateScanExecutionObject,
   mockScanExecutionWithDefaultVariablesManifest,
+  mockCustomScanExecutionWithDefaultVariablesManifest,
   mockCustomScanExecutionObject,
 } from 'ee_jest/security_orchestration/mocks/mock_scan_execution_policy_data';
 
@@ -49,6 +47,7 @@ import {
   POLICY_ACTION_BUILDER_DAST_PROFILES_ERROR_KEY,
   RUNNER_TAGS_PARSING_ERROR,
   DAST_SCANNERS_PARSING_ERROR,
+  SELECTION_CONFIG_CUSTOM,
 } from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
 import { RULE_KEY_MAP } from 'ee/security_orchestration/components/policy_editor/scan_execution/lib/rules';
 import {
@@ -91,7 +90,6 @@ describe('EditorComponent', () => {
     wrapper = shallowMountExtended(EditorComponent, {
       apolloProvider: createMockApolloProvider(handler),
       propsData: {
-        assignedPolicyProject: DEFAULT_ASSIGNED_POLICY_PROJECT,
         selectedPolicyType: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
         errorSources: [],
         isCreating: false,
@@ -138,29 +136,26 @@ describe('EditorComponent', () => {
   const findDisabledAction = () => wrapper.findByTestId('disabled-action');
   const findDisabledRule = () => wrapper.findByTestId('disabled-rule');
   const findSkipCiSelector = () => wrapper.findComponent(SkipCiSelector);
-  const findActionBuilderDefaultConfig = () => wrapper.findByTestId('default-action-config');
-  const findActionBuilderDefaultConfigRadioButton = () =>
-    wrapper.findByTestId('default-action-config-radio-button');
-  const findActionBuilderCustomConfig = () => wrapper.findByTestId('custom-action-config');
-  const findActionBuilderCustomConfigRadioButton = () =>
-    wrapper.findByTestId('default-action-config-radio-button');
   const findOptimizedScanSelector = () => wrapper.findComponent(OptimizedScanSelector);
   const findRuleStrategySelector = () => wrapper.findComponent(RuleStrategySelector);
   const findConfigurationSelection = () => wrapper.findByTestId('configuration-selection');
+  const findRadioFormGroup = () => wrapper.findComponent(GlFormRadioGroup);
+  const findActionBuilderCustomConfig = () => wrapper.findByTestId('custom-action-config');
+  const findActionBuilderDefaultConfig = () => wrapper.findByTestId('default-action-config');
+  const findActionBuilderDefaultConfigRadioButton = () => findRadioFormGroup().props('options')[0];
 
   const selectScheduleRule = async () => {
     await findRuleSection().vm.$emit('changed', buildDefaultScheduleRule());
   };
 
   beforeEach(() => {
-    uniqueId.mockImplementation(jest.fn((prefix) => `${prefix}0`));
+    uniqueId
+      .mockImplementationOnce(jest.fn((prefix) => `${prefix}0`))
+      .mockImplementationOnce(jest.fn((prefix) => `${prefix}1`))
+      .mockImplementationOnce(jest.fn((prefix) => `${prefix}2`));
   });
 
   describe('default', () => {
-    beforeEach(() => {
-      factory();
-    });
-
     describe('scope', () => {
       it.each`
         namespaceType              | expected
@@ -182,8 +177,8 @@ describe('EditorComponent', () => {
 
       it('renders optimized scanner by default', () => {
         factory();
-        expect(findActionBuilderDefaultConfigRadioButton().props('checked')).toBe('default');
-        expect(findActionBuilderDefaultConfigRadioButton().attributes().disabled).toBe(undefined);
+        expect(findRadioFormGroup().attributes('checked')).toBe('default');
+        expect(findActionBuilderDefaultConfigRadioButton().disabled).toBe(false);
       });
 
       it('does not show custom configuration section', () => {
@@ -196,17 +191,16 @@ describe('EditorComponent', () => {
         factory();
 
         // Switch to custom config first
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
 
         // Add a DAST scan action, but there are many reasons the policy may be invalid for
         // optimized scans. See the getConfiguration method in
         // ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/lib/index.js
         // for more info
         const dastAction = { scan: 'dast' };
-        findActionBuilder().vm.$emit('changed', dastAction);
-        await nextTick();
+        await findActionBuilder().vm.$emit('changed', dastAction);
 
-        expect(findActionBuilderDefaultConfigRadioButton().attributes().disabled).toBe('true');
+        expect(findRadioFormGroup().props('options')[0].disabled).toBe(true);
       });
     });
   });
@@ -226,9 +220,8 @@ describe('EditorComponent', () => {
   });
 
   describe('when a user is not an owner of the project', () => {
-    it('displays the empty state with the appropriate properties', async () => {
+    it('displays the empty state with the appropriate properties', () => {
       factory({ provide: { disableScanPolicyUpdate: true } });
-      await nextTick();
       const emptyState = findEmptyState();
 
       expect(emptyState.props('primaryButtonLink')).toMatch(scanPolicyDocumentationPath);
@@ -240,20 +233,18 @@ describe('EditorComponent', () => {
   describe('yaml mode', () => {
     beforeEach(factory);
 
-    it('updates the yaml and policy object when "update-yaml" is emitted', async () => {
-      const newManifest = `name: test
-enabled: true`;
-
+    it('renders yaml mode properties correctly', () => {
       expect(findPolicyEditorLayout().props()).toMatchObject({
         parsingError: '',
-        policy: fromYaml({
-          manifest: DEFAULT_SCAN_EXECUTION_POLICY_WITH_SCOPE,
-          type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-        }),
         yamlEditorValue: mockScanExecutionWithDefaultVariablesManifest,
       });
-      findPolicyEditorLayout().vm.$emit('update-yaml', newManifest);
-      await nextTick();
+    });
+
+    it('updates the yaml and policy object when "update-yaml" is emitted', async () => {
+      const newManifest = `name: test
+enabled: true`;
+      await findPolicyEditorLayout().vm.$emit('update-yaml', newManifest);
+
       expect(findPolicyEditorLayout().props()).toMatchObject({
         parsingError: '',
         policy: expect.objectContaining({ enabled: true }),
@@ -273,8 +264,7 @@ enabled: true`;
           `${component}: ${oldValue}`,
         );
 
-        findPolicyEditorLayout().vm.$emit('update-property', component, newValue);
-        await nextTick();
+        await findPolicyEditorLayout().vm.$emit('update-property', component, newValue);
 
         expect(findPolicyEditorLayout().props('policy')[component]).toBe(newValue);
         expect(findPolicyEditorLayout().props('yamlEditorValue')).toMatch(
@@ -330,97 +320,73 @@ enabled: true`;
     describe('custom configuration', () => {
       it('should add new rule', async () => {
         factory();
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
-
-        const initialValue = [RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE]()];
-        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(initialValue);
-        expect(
-          fromYaml({
-            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-          }).rules,
-        ).toStrictEqual(initialValue);
-        expect(findAllRuleSections()).toHaveLength(1);
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await findAddRuleButton().vm.$emit('click');
 
-        findAddRuleButton().vm.$emit('click');
-        await nextTick();
-
-        const finalValue = [
-          RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](),
-          RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](),
-        ];
-        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(finalValue);
-        expect(
-          fromYaml({
-            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-          }).rules,
-        ).toStrictEqual(finalValue);
-        expect(findAllRuleSections()).toHaveLength(2);
+        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual([
+          { branch_type: 'default', id: undefined, type: 'pipeline' },
+          {
+            branch_type: 'target_default',
+            id: undefined,
+            pipeline_sources: { including: ['merge_request_event'] },
+            type: 'pipeline',
+          },
+          { branches: ['*'], id: undefined, type: 'pipeline' },
+        ]);
+        expect(findAllRuleSections()).toHaveLength(3);
       });
 
-      it('should add a new rule if the rule property does not exist', async () => {
-        factory({ propsData: { existingPolicy: { name: 'test' }, isEditing: true } });
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+      it('should add a new rule if there are zero rules', async () => {
+        await factory({
+          propsData: { existingPolicy: { name: 'test', rules: [] }, isEditing: true },
+        });
         expect(findAllRuleSections()).toHaveLength(0);
-        findAddRuleButton().vm.$emit('click');
-        await nextTick();
+        await findAddRuleButton().vm.$emit('click');
         expect(findAllRuleSections()).toHaveLength(1);
       });
 
       it('should update rule', async () => {
         factory();
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
-        const initialValue = [RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE]()];
-        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(initialValue);
-        expect(
-          fromYaml({
-            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-          }).rules,
-        ).toStrictEqual(initialValue);
-
-        const finalValue = [
-          { ...RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](), branches: ['main'] },
-        ];
-        findRuleSection().vm.$emit('changed', finalValue[0]);
-        await nextTick();
-
-        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual(finalValue);
-        expect(
-          fromYaml({
-            manifest: findPolicyEditorLayout().props('yamlEditorValue'),
-            type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
-          }).rules,
-        ).toStrictEqual(finalValue);
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await findRuleSection().vm.$emit('changed', {
+          ...RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](),
+          branches: ['main'],
+        });
+        expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual([
+          { branches: ['main'], id: undefined, type: 'pipeline' },
+          {
+            branch_type: 'target_default',
+            id: undefined,
+            pipeline_sources: { including: ['merge_request_event'] },
+            type: 'pipeline',
+          },
+        ]);
       });
 
       it('should remove rule', async () => {
         factory();
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
-        findAddRuleButton().vm.$emit('click');
-        await nextTick();
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await findAddRuleButton().vm.$emit('click');
 
-        expect(findAllRuleSections()).toHaveLength(2);
-        expect(findPolicyEditorLayout().props('policy').rules).toHaveLength(2);
+        expect(findAllRuleSections()).toHaveLength(3);
+        expect(findPolicyEditorLayout().props('policy').rules).toHaveLength(3);
         expect(
           fromYaml({
             manifest: findPolicyEditorLayout().props('yamlEditorValue'),
             type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
           }).rules,
-        ).toHaveLength(2);
+        ).toHaveLength(3);
 
-        findRuleSection().vm.$emit('remove', 1);
-        await nextTick();
+        await findRuleSection().vm.$emit('remove', 1);
 
-        expect(findAllRuleSections()).toHaveLength(1);
-        expect(findPolicyEditorLayout().props('policy').rules).toHaveLength(1);
+        expect(findAllRuleSections()).toHaveLength(2);
+        expect(findPolicyEditorLayout().props('policy').rules).toHaveLength(2);
         expect(
           fromYaml({
             manifest: findPolicyEditorLayout().props('yamlEditorValue'),
             type: POLICY_TYPE_COMPONENT_OPTIONS.scanExecution.urlParameter,
           }).rules,
-        ).toHaveLength(1);
+        ).toHaveLength(2);
       });
     });
   });
@@ -491,14 +457,14 @@ enabled: true`;
       ];
       it('does not show default configuration section', async () => {
         factory();
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
         expect(findActionBuilderDefaultConfig().exists()).toBe(false);
         expect(findActionBuilderCustomConfig().exists()).toBe(true);
       });
 
       it('adds new action', async () => {
         factory();
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
 
         expect(findPolicyEditorLayout().props('policy').actions).toEqual(
           expect.objectContaining(newActions),
@@ -510,8 +476,7 @@ enabled: true`;
           }).actions,
         ).toEqual(expect.objectContaining(newActions));
 
-        findAddActionButton().vm.$emit('click');
-        await nextTick();
+        await findAddActionButton().vm.$emit('click');
 
         const finalValue = [
           buildScannerAction({
@@ -535,12 +500,11 @@ enabled: true`;
         factory({
           propsData: { existingPolicy: { name: 'test' }, isEditing: true },
         });
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
 
         expect(findAllActionBuilders()).toHaveLength(0);
 
-        findAddActionButton().vm.$emit('click');
-        await nextTick();
+        await findAddActionButton().vm.$emit('click');
 
         expect(findAddActionButtonWrapper().attributes('title')).toBe('');
         expect(findAllActionBuilders()).toHaveLength(1);
@@ -548,7 +512,7 @@ enabled: true`;
 
       it('updates action', async () => {
         factory();
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
 
         const initialValue = [
           buildScannerAction({
@@ -570,8 +534,7 @@ enabled: true`;
         ).toEqual(expect.objectContaining(newActions));
 
         const finalValue = [buildScannerAction({ scanner: 'sast', withDefaultVariables: true })];
-        findActionBuilder().vm.$emit('changed', finalValue[0]);
-        await nextTick();
+        await findActionBuilder().vm.$emit('changed', finalValue[0]);
 
         expect(findPolicyEditorLayout().props('policy').actions).toStrictEqual(finalValue);
         expect(
@@ -584,9 +547,8 @@ enabled: true`;
 
       it('removes action', async () => {
         factory();
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
-        findAddActionButton().vm.$emit('click');
-        await nextTick();
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await findAddActionButton().vm.$emit('click');
 
         expect(findAllActionBuilders()).toHaveLength(2);
         expect(findPolicyEditorLayout().props('policy').actions).toHaveLength(2);
@@ -597,8 +559,7 @@ enabled: true`;
           }).actions,
         ).toHaveLength(2);
 
-        findActionBuilder().vm.$emit('remove', 1);
-        await nextTick();
+        await findActionBuilder().vm.$emit('remove', 1);
 
         expect(findAllActionBuilders()).toHaveLength(1);
         expect(findPolicyEditorLayout().props('policy').actions).toHaveLength(1);
@@ -613,7 +574,7 @@ enabled: true`;
       it('limits number of actions', async () => {
         const MAX_ACTIONS = 3;
         factory({ provide: { maxScanExecutionPolicyActions: MAX_ACTIONS } });
-        await findActionBuilderCustomConfigRadioButton().vm.$emit('input');
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
 
         expect(findAddActionButton().attributes().disabled).toBeUndefined();
         expect(findAllActionBuilders()).toHaveLength(1);
@@ -638,8 +599,8 @@ enabled: true`;
       ${'DAST profiles'} | ${POLICY_ACTION_BUILDER_DAST_PROFILES_ERROR_KEY} | ${DAST_SCANNERS_PARSING_ERROR}
     `('disables action section when parsing of $name fails', async ({ errorKey, error }) => {
       factory();
-      findActionBuilder().vm.$emit('parsing-error', errorKey);
-      await nextTick();
+      await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+      await findActionBuilder().vm.$emit('parsing-error', errorKey);
       expect(findDisabledAction().props()).toEqual({ disabled: true, error });
       expect(findDisabledRule().props()).toEqual({
         disabled: false,
@@ -669,8 +630,7 @@ enabled: true`;
         disabled: true,
         error: CONDITION_SECTION_DISABLE_ERROR,
       });
-      findActionBuilder().vm.$emit('parsing-error', POLICY_ACTION_BUILDER_TAGS_ERROR_KEY);
-      await nextTick();
+      await findActionBuilder().vm.$emit('parsing-error', POLICY_ACTION_BUILDER_TAGS_ERROR_KEY);
       expect(findDisabledRule().props()).toEqual({
         disabled: true,
         error: CONDITION_SECTION_DISABLE_ERROR,
@@ -681,8 +641,9 @@ enabled: true`;
   describe('performance warning modal', () => {
     describe('group', () => {
       describe('performance threshold not reached', () => {
-        beforeEach(() => {
+        beforeEach(async () => {
           factory();
+          await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
         });
 
         it('saves policy when performance threshold is not reached', async () => {
@@ -724,6 +685,7 @@ enabled: true`;
           });
 
           await waitForPromises();
+          await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
         });
 
         it('shows the warning when performance threshold is reached but schedule rules were selected', async () => {
@@ -830,6 +792,7 @@ enabled: true`;
         });
 
         await waitForPromises();
+        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
       });
 
       it('does not show the warning when performance threshold is reached but schedule rules were selected for a project', async () => {
@@ -885,7 +848,7 @@ enabled: true`;
     it('renders default yaml in new format', () => {
       factoryWithExistingPolicy({ policy: mockCustomScanExecutionObject });
       expect(findPolicyEditorLayout().props('yamlEditorValue')).toBe(
-        mockScanExecutionWithDefaultVariablesManifest,
+        mockCustomScanExecutionWithDefaultVariablesManifest,
       );
     });
 
diff --git a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/actions_spec.js b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/actions_spec.js
index 42da8d7ccca62c..858e58063487ab 100644
--- a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/actions_spec.js
+++ b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/lib/actions_spec.js
@@ -15,7 +15,7 @@ import {
 } from '~/vue_shared/security_reports/constants';
 import {
   mockCustomScanExecutionManifest,
-  mockScanExecutionWithDefaultVariablesManifest,
+  mockCustomScanExecutionWithDefaultVariablesManifest,
 } from 'ee_jest/security_orchestration/mocks/mock_scan_execution_policy_data';
 
 const actionId = 'action_0';
@@ -96,7 +96,7 @@ describe('addDefaultVariablesToManifest', () => {
       addDefaultVariablesToManifest({
         manifest: mockCustomScanExecutionManifest,
       }),
-    ).toBe(mockScanExecutionWithDefaultVariablesManifest);
+    ).toBe(mockCustomScanExecutionWithDefaultVariablesManifest);
   });
 });
 
diff --git a/ee/spec/frontend/security_orchestration/components/utils_spec.js b/ee/spec/frontend/security_orchestration/components/utils_spec.js
index c380ab3a388586..373f8a3bb815f6 100644
--- a/ee/spec/frontend/security_orchestration/components/utils_spec.js
+++ b/ee/spec/frontend/security_orchestration/components/utils_spec.js
@@ -312,11 +312,18 @@ describe('checkForPerformanceRisk', () => {
   describe('extractPolicyContent', () => {
     const defaultPayload = {};
     const extractedPolicyContent = {
-      actions: [{ scan: 'secret_detection' }],
+      actions: [{ scan: 'secret_detection', template: 'latest' }],
       description: '',
       enabled: true,
       name: '',
-      rules: [{ branches: ['*'], type: 'pipeline' }],
+      rules: [
+        { branch_type: 'default', type: 'pipeline' },
+        {
+          branch_type: 'target_default',
+          pipeline_sources: { including: ['merge_request_event'] },
+          type: 'pipeline',
+        },
+      ],
       skip_ci: {
         allowed: true,
       },
diff --git a/ee/spec/frontend/security_orchestration/mocks/mock_data.js b/ee/spec/frontend/security_orchestration/mocks/mock_data.js
index acc2213d79f82c..83e7ada49e9108 100644
--- a/ee/spec/frontend/security_orchestration/mocks/mock_data.js
+++ b/ee/spec/frontend/security_orchestration/mocks/mock_data.js
@@ -95,15 +95,6 @@ export const SCAN_EXECUTION_DEFAULT_POLICY = {
   name: '',
   description: '',
   enabled: true,
-  rules: [
-    { type: 'pipeline', branch_type: 'default', id: 'rule_0' },
-    {
-      id: 'rule_0',
-      type: 'pipeline',
-      branch_type: 'target_default',
-      pipeline_sources: { including: ['merge_request_event'] },
-    },
-  ],
   actions: [
     {
       id: 'action_0',
@@ -112,6 +103,15 @@ export const SCAN_EXECUTION_DEFAULT_POLICY = {
       variables: { SECURE_ENABLE_LOCAL_CONFIGURATION: 'false' },
     },
   ],
+  rules: [
+    { type: 'pipeline', branch_type: 'default', id: 'rule_1' },
+    {
+      id: 'rule_2',
+      type: 'pipeline',
+      branch_type: 'target_default',
+      pipeline_sources: { including: ['merge_request_event'] },
+    },
+  ],
   skip_ci: DEFAULT_SKIP_SI_CONFIGURATION,
 };
 
diff --git a/ee/spec/frontend/security_orchestration/mocks/mock_scan_execution_policy_data.js b/ee/spec/frontend/security_orchestration/mocks/mock_scan_execution_policy_data.js
index 14f859a9ea593d..c10fd7b5fda8a9 100644
--- a/ee/spec/frontend/security_orchestration/mocks/mock_scan_execution_policy_data.js
+++ b/ee/spec/frontend/security_orchestration/mocks/mock_scan_execution_policy_data.js
@@ -81,7 +81,7 @@ export const mockCustomScanExecutionObject = {
   skip_ci: { allowed: true },
 };
 
-export const mockScanExecutionWithDefaultVariablesManifest = `scan_execution_policy:
+export const mockCustomScanExecutionWithDefaultVariablesManifest = `scan_execution_policy:
   - name: ''
     description: ''
     enabled: true
@@ -97,6 +97,30 @@ export const mockScanExecutionWithDefaultVariablesManifest = `scan_execution_pol
       allowed: true
 `;
 
+export const mockScanExecutionWithDefaultVariablesManifest = `scan_execution_policy:
+  - name: ''
+    description: ''
+    enabled: true
+    policy_scope:
+      projects:
+        excluding: []
+    rules:
+      - type: pipeline
+        branch_type: default
+      - type: pipeline
+        branch_type: target_default
+        pipeline_sources:
+          including:
+            - merge_request_event
+    actions:
+      - scan: secret_detection
+        template: latest
+        variables:
+          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
+    skip_ci:
+      allowed: true
+`;
+
 export const mockScheduleScanExecutionManifest = defaultMockScanExecutionManifest.concat(`
 rules:
   - type: schedule
-- 
GitLab


From d527f42dbaa8d811ae8657ee0bd58d0fd2de7784 Mon Sep 17 00:00:00 2001
From: Alexander Turinske <aturinske@gitlab.com>
Date: Thu, 16 Oct 2025 11:06:34 -0600
Subject: [PATCH 3/4] Update integration and feature tests

- update integration tests
- update feature tests
---
 .../scan_execution/editor_component.vue       |  1 +
 .../beta/flexible_scan_execution_policy.yml   | 10 ---
 ...user_creates_scan_execution_policy_spec.rb |  1 -
 ...user_creates_scan_execution_policy_spec.rb |  1 -
 .../scan_execution/editor_component_spec.js   | 34 +++----
 .../policy_editor/mocks/mocks.js              | 20 +++++
 .../policy_editor/policy_scope/mocks.js       | 80 +++++------------
 .../scan_execution/actions_spec.js            | 47 ++++------
 .../policy_editor/scan_execution/mocks.js     | 88 +++++++------------
 .../scan_execution/rules_spec.js              | 27 ++++--
 .../scan_execution/split_view_layout_spec.js  | 11 ++-
 ...g_scan_execution_policy_shared_examples.rb | 11 ++-
 12 files changed, 149 insertions(+), 182 deletions(-)
 delete mode 100644 ee/config/feature_flags/beta/flexible_scan_execution_policy.yml

diff --git a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue
index 2522251c6e0f01..30e5bfc481b53c 100644
--- a/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue
+++ b/ee/app/assets/javascripts/security_orchestration/components/policy_editor/scan_execution/editor_component.vue
@@ -428,6 +428,7 @@ export default {
           <gl-form-radio-group
             :checked="configType"
             :options="configurationOptions"
+            data-testid="enforcement-selection"
             @input="updateConfigType"
           />
         </div>
diff --git a/ee/config/feature_flags/beta/flexible_scan_execution_policy.yml b/ee/config/feature_flags/beta/flexible_scan_execution_policy.yml
deleted file mode 100644
index 9efe1b1203f82d..00000000000000
--- a/ee/config/feature_flags/beta/flexible_scan_execution_policy.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-name: flexible_scan_execution_policy
-description:
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/541370
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/191015
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/541689
-milestone: '18.0'
-group: group::security policies
-type: beta
-default_enabled: true
diff --git a/ee/spec/features/groups/security/user_creates_scan_execution_policy_spec.rb b/ee/spec/features/groups/security/user_creates_scan_execution_policy_spec.rb
index f9cf08d966ca49..ced36b03f95834 100644
--- a/ee/spec/features/groups/security/user_creates_scan_execution_policy_spec.rb
+++ b/ee/spec/features/groups/security/user_creates_scan_execution_policy_spec.rb
@@ -22,7 +22,6 @@
   before do
     sign_in(owner)
     stub_feature_flags(security_policies_split_view: false)
-    stub_feature_flags(flexible_scan_execution_policy: false)
   end
 
   it_behaves_like 'creating scan execution policy with valid properties'
diff --git a/ee/spec/features/projects/security/user_creates_scan_execution_policy_spec.rb b/ee/spec/features/projects/security/user_creates_scan_execution_policy_spec.rb
index ae296453e7f60a..dd0017a80cb2bb 100644
--- a/ee/spec/features/projects/security/user_creates_scan_execution_policy_spec.rb
+++ b/ee/spec/features/projects/security/user_creates_scan_execution_policy_spec.rb
@@ -18,7 +18,6 @@
   before do
     sign_in(owner)
     stub_feature_flags(security_policies_split_view: false)
-    stub_feature_flags(flexible_scan_execution_policy: false)
   end
 
   it_behaves_like 'creating scan execution policy with valid properties'
diff --git a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js
index 07507e8edfbadd..dc137306ca32c6 100644
--- a/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js
+++ b/ee/spec/frontend/security_orchestration/components/policy_editor/scan_execution/editor_component_spec.js
@@ -148,6 +148,10 @@ describe('EditorComponent', () => {
     await findRuleSection().vm.$emit('changed', buildDefaultScheduleRule());
   };
 
+  const navigateToCustomMode = async () => {
+    await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+  };
+
   beforeEach(() => {
     uniqueId
       .mockImplementationOnce(jest.fn((prefix) => `${prefix}0`))
@@ -189,9 +193,7 @@ describe('EditorComponent', () => {
 
       it('disables default configuration when the policy is incompatible', async () => {
         factory();
-
-        // Switch to custom config first
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
 
         // Add a DAST scan action, but there are many reasons the policy may be invalid for
         // optimized scans. See the getConfiguration method in
@@ -320,7 +322,7 @@ enabled: true`;
     describe('custom configuration', () => {
       it('should add new rule', async () => {
         factory();
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
         await findAddRuleButton().vm.$emit('click');
 
         expect(findPolicyEditorLayout().props('policy').rules).toStrictEqual([
@@ -347,7 +349,7 @@ enabled: true`;
 
       it('should update rule', async () => {
         factory();
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
         await findRuleSection().vm.$emit('changed', {
           ...RULE_KEY_MAP[SCAN_EXECUTION_PIPELINE_RULE](),
           branches: ['main'],
@@ -365,7 +367,7 @@ enabled: true`;
 
       it('should remove rule', async () => {
         factory();
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
         await findAddRuleButton().vm.$emit('click');
 
         expect(findAllRuleSections()).toHaveLength(3);
@@ -457,14 +459,14 @@ enabled: true`;
       ];
       it('does not show default configuration section', async () => {
         factory();
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
         expect(findActionBuilderDefaultConfig().exists()).toBe(false);
         expect(findActionBuilderCustomConfig().exists()).toBe(true);
       });
 
       it('adds new action', async () => {
         factory();
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
 
         expect(findPolicyEditorLayout().props('policy').actions).toEqual(
           expect.objectContaining(newActions),
@@ -500,7 +502,7 @@ enabled: true`;
         factory({
           propsData: { existingPolicy: { name: 'test' }, isEditing: true },
         });
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
 
         expect(findAllActionBuilders()).toHaveLength(0);
 
@@ -512,7 +514,7 @@ enabled: true`;
 
       it('updates action', async () => {
         factory();
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
 
         const initialValue = [
           buildScannerAction({
@@ -547,7 +549,7 @@ enabled: true`;
 
       it('removes action', async () => {
         factory();
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
         await findAddActionButton().vm.$emit('click');
 
         expect(findAllActionBuilders()).toHaveLength(2);
@@ -574,7 +576,7 @@ enabled: true`;
       it('limits number of actions', async () => {
         const MAX_ACTIONS = 3;
         factory({ provide: { maxScanExecutionPolicyActions: MAX_ACTIONS } });
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
 
         expect(findAddActionButton().attributes().disabled).toBeUndefined();
         expect(findAllActionBuilders()).toHaveLength(1);
@@ -599,7 +601,7 @@ enabled: true`;
       ${'DAST profiles'} | ${POLICY_ACTION_BUILDER_DAST_PROFILES_ERROR_KEY} | ${DAST_SCANNERS_PARSING_ERROR}
     `('disables action section when parsing of $name fails', async ({ errorKey, error }) => {
       factory();
-      await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+      await navigateToCustomMode();
       await findActionBuilder().vm.$emit('parsing-error', errorKey);
       expect(findDisabledAction().props()).toEqual({ disabled: true, error });
       expect(findDisabledRule().props()).toEqual({
@@ -643,7 +645,7 @@ enabled: true`;
       describe('performance threshold not reached', () => {
         beforeEach(async () => {
           factory();
-          await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+          await navigateToCustomMode();
         });
 
         it('saves policy when performance threshold is not reached', async () => {
@@ -685,7 +687,7 @@ enabled: true`;
           });
 
           await waitForPromises();
-          await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+          await navigateToCustomMode();
         });
 
         it('shows the warning when performance threshold is reached but schedule rules were selected', async () => {
@@ -792,7 +794,7 @@ enabled: true`;
         });
 
         await waitForPromises();
-        await findRadioFormGroup().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+        await navigateToCustomMode();
       });
 
       it('does not show the warning when performance threshold is reached but schedule rules were selected for a project', async () => {
diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/mocks/mocks.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/mocks/mocks.js
index 269b9ae9a32e24..2ffb15a58168ef 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/mocks/mocks.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/mocks/mocks.js
@@ -35,3 +35,23 @@ export const DEFAULT_PROVIDE = {
 export const SCAN_EXECUTION_POLICY = 'scan_execution_policy';
 export const PIPELINE_EXECUTION_POLICY = 'pipeline_execution_policy';
 export const APPROVAL_POLICY = 'approval_policy';
+
+export const SCAN_EXECUTION_DEFAULT = {
+  rules: `    rules:
+      - type: pipeline
+        branch_type: default
+      - type: pipeline
+        branch_type: target_default
+        pipeline_sources:
+          including:
+            - merge_request_event`,
+
+  actions: `    actions:
+      - scan: secret_detection
+        template: latest
+        variables:
+          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'`,
+
+  skip: `    skip_ci:
+      allowed: true`,
+};
diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/policy_scope/mocks.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/policy_scope/mocks.js
index 5eb80844275ca2..307bd16ec24af6 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/policy_scope/mocks.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/policy_scope/mocks.js
@@ -1,3 +1,5 @@
+import { SCAN_EXECUTION_DEFAULT } from '../mocks/mocks';
+
 export const mockScanExecutionActionManifest = `scan_execution_policy:
   - name: ''
     description: ''
@@ -6,32 +8,18 @@ export const mockScanExecutionActionManifest = `scan_execution_policy:
       compliance_frameworks:
         - id: 1
         - id: 2
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.rules}
+${SCAN_EXECUTION_DEFAULT.actions}
+${SCAN_EXECUTION_DEFAULT.skip}
 `;
 
 export const mockScanExecutionActionProjectManifest = `scan_execution_policy:
   - name: ''
     description: ''
     enabled: true
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.rules}
+${SCAN_EXECUTION_DEFAULT.actions}
+${SCAN_EXECUTION_DEFAULT.skip}
     policy_scope:
       compliance_frameworks:
         - id: 1
@@ -120,16 +108,9 @@ export const EXCLUDING_PROJECTS_MOCKS = {
         excluding:
           - id: 1
           - id: 2
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.rules}
+${SCAN_EXECUTION_DEFAULT.actions}
+${SCAN_EXECUTION_DEFAULT.skip}
 `,
   PIPELINE_EXECUTION: `name: ''
 description: ''
@@ -179,16 +160,9 @@ export const EXCLUDING_PROJECTS_PROJECTS_LEVEL_MOCKS = {
   - name: ''
     description: ''
     enabled: true
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.rules}
+${SCAN_EXECUTION_DEFAULT.actions}
+${SCAN_EXECUTION_DEFAULT.skip}
     policy_scope:
       projects:
         excluding:
@@ -268,16 +242,9 @@ export const INCLUDING_GROUPS_WITH_EXCEPTIONS_MOCKS = {
           - id: 2
       projects:
         excluding: []
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.rules}
+${SCAN_EXECUTION_DEFAULT.actions}
+${SCAN_EXECUTION_DEFAULT.skip}
 `,
   PIPELINE_EXECUTION: `pipeline_execution_policy:
   - name: ''
@@ -343,16 +310,9 @@ export const INCLUDING_GROUPS_MOCKS = {
           - id: 2
       projects:
         excluding: []
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.rules}
+${SCAN_EXECUTION_DEFAULT.actions}
+${SCAN_EXECUTION_DEFAULT.skip}
 `,
   PIPELINE_EXECUTION: `pipeline_execution_policy:
   - name: ''
diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/actions_spec.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/actions_spec.js
index 016905b69d8146..705e677fd3f063 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/actions_spec.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/actions_spec.js
@@ -1,5 +1,5 @@
-import { mountExtended } from 'helpers/vue_test_utils_helper';
 import * as urlUtils from '~/lib/utils/url_utility';
+import { mountExtended } from 'helpers/vue_test_utils_helper';
 import App from 'ee/security_orchestration/components/policy_editor/app.vue';
 import GroupDastProfileSelector from 'ee/security_orchestration/components/policy_editor/scan_execution/action/scan_filters/group_dast_profile_selector.vue';
 import ProjectDastProfileSelector from 'ee/security_orchestration/components/policy_editor/scan_execution/action/scan_filters/project_dast_profile_selector.vue';
@@ -9,6 +9,7 @@ import {
   DEFAULT_ASSIGNED_POLICY_PROJECT,
   NAMESPACE_TYPES,
 } from 'ee/security_orchestration/constants';
+import { SELECTION_CONFIG_CUSTOM } from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
 import {
   REPORT_TYPE_SAST,
   REPORT_TYPE_SAST_IAC,
@@ -53,36 +54,22 @@ describe('Scan execution policy actions', () => {
   });
 
   const findCiVariablesSelectors = () => wrapper.findComponent(CiVariablesSelectors);
-  const findScanTypeSelector = () => wrapper.findByTestId('scan-type-selector');
+  const findDisabledActionSection = () => wrapper.findByTestId('disabled-action');
+  const findEnforcementSelection = () => wrapper.findByTestId('enforcement-selection');
   const findGroupDastProfileSelector = () => wrapper.findComponent(GroupDastProfileSelector);
   const findProjectDastProfileSelector = () => wrapper.findComponent(ProjectDastProfileSelector);
   const findRunnerTagsList = () => wrapper.findComponent(RunnerTagsList);
   const findScanFilterButton = () => wrapper.findByTestId('add-variable-button');
-  const findDisabledActionSection = () => wrapper.findByTestId('disabled-action');
-
-  describe('secret detection', () => {
-    beforeEach(() => {
-      createWrapper();
-    });
-
-    it('selects secret detection scan as action', async () => {
-      const verifyRuleMode = () => {
-        expect(findScanTypeSelector().exists()).toBe(true);
-        expect(findRunnerTagsList().exists()).toBe(true);
-        expect(findDisabledActionSection().props('disabled')).toBe(false);
-      };
+  const findScanTypeSelector = () => wrapper.findByTestId('scan-type-selector');
 
-      await verify({
-        manifest: createScanActionScanExecutionManifest(REPORT_TYPE_SECRET_DETECTION),
-        verifyRuleMode,
-        wrapper,
-      });
-    });
-  });
+  const navigateToCustomMode = async () => {
+    await findEnforcementSelection().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+  };
 
-  describe('non dast scanners', () => {
-    beforeEach(() => {
-      createWrapper();
+  describe('non-dast scanners', () => {
+    beforeEach(async () => {
+      await createWrapper();
+      await navigateToCustomMode();
     });
 
     it.each`
@@ -115,7 +102,8 @@ describe('Scan execution policy actions', () => {
     `(
       'selects secret detection dast as action',
       async ({ namespaceType, findDastSelector, manifest }) => {
-        createWrapper({ provide: { namespaceType } });
+        await createWrapper({ provide: { namespaceType } });
+        await navigateToCustomMode();
 
         const verifyRuleMode = () => {
           expect(findScanTypeSelector().exists()).toBe(true);
@@ -132,8 +120,9 @@ describe('Scan execution policy actions', () => {
   });
 
   describe('actions filters', () => {
-    beforeEach(() => {
-      createWrapper();
+    beforeEach(async () => {
+      await createWrapper();
+      await navigateToCustomMode();
     });
 
     it('selects variables filter', async () => {
@@ -144,7 +133,9 @@ describe('Scan execution policy actions', () => {
         expect(findDisabledActionSection().props('disabled')).toBe(false);
       };
 
+      await findScanTypeSelector().vm.$emit('select', REPORT_TYPE_SECRET_DETECTION);
       await findScanFilterButton().vm.$emit('click');
+      await findCiVariablesSelectors().vm.$emit('input', { variables: { a: 'b' } });
       await verify({
         manifest: mockActionsVariablesScanExecutionManifest,
         verifyRuleMode,
diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/mocks.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/mocks.js
index b952cd27403488..596db278be4c4d 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/mocks.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/mocks.js
@@ -1,52 +1,42 @@
 import { POLICY_TYPE_COMPONENT_OPTIONS } from 'ee/security_orchestration/components/constants';
 import { fromYaml } from 'ee/security_orchestration/components/utils';
+import { SCAN_EXECUTION_DEFAULT } from '../mocks/mocks';
 
 export const mockScanExecutionManifest = `scan_execution_policy:
   - name: ''
     description: ''
     enabled: true
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.rules}
+${SCAN_EXECUTION_DEFAULT.actions}
+${SCAN_EXECUTION_DEFAULT.skip}
 `;
 
-const mockScanExecutionManifestParsed = `scan_execution_policy:
+export const mockAllBranchesScanExecutionManifest = `scan_execution_policy:
   - name: ''
     description: ''
     enabled: true
     rules:
       - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
+        branch_type: all
+      - type: pipeline
+        branch_type: target_default
+        pipeline_sources:
+          including:
+            - merge_request_event
+${SCAN_EXECUTION_DEFAULT.actions}
+${SCAN_EXECUTION_DEFAULT.skip}
 `;
 
 export const mockDastActionScanExecutionManifest = `scan_execution_policy:
   - name: ''
     description: ''
     enabled: true
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
+${SCAN_EXECUTION_DEFAULT.rules}
     actions:
       - scan: dast
         site_profile: ''
         scanner_profile: ''
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.skip}
 `;
 
 export const mockGroupDastActionScanExecutionManifest = `scan_execution_policy:
@@ -56,38 +46,31 @@ export const mockGroupDastActionScanExecutionManifest = `scan_execution_policy:
     policy_scope:
       projects:
         excluding: []
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
+${SCAN_EXECUTION_DEFAULT.rules}
     actions:
       - scan: dast
         site_profile: ''
         scanner_profile: ''
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.skip}
 `;
 
 export const mockActionsVariablesScanExecutionManifest = `scan_execution_policy:
   - name: ''
     description: ''
     enabled: true
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
+${SCAN_EXECUTION_DEFAULT.rules}
     actions:
       - scan: secret_detection
         variables:
+          a: b
           SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-          '': ''
-    skip_ci:
-      allowed: true
+${SCAN_EXECUTION_DEFAULT.skip}
 `;
 
-export const createScanActionScanExecutionManifest = (scanType, parsed = false) => {
-  const parser = parsed ? mockScanExecutionManifestParsed : mockScanExecutionManifest;
-  return parser.replace('scan: secret_detection', `scan: ${scanType}`);
+export const createScanActionScanExecutionManifest = (scanType) => {
+  return mockScanExecutionManifest
+    .replace('scan: secret_detection', `scan: ${scanType}`)
+    .replace('\n        template: latest', '');
 };
 
 export const mockScheduleScanExecutionManifest = `scan_execution_policy:
@@ -98,26 +81,21 @@ export const mockScheduleScanExecutionManifest = `scan_execution_policy:
       - type: schedule
         branches: []
         cadence: 0 0 * * *
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
-    skip_ci:
-      allowed: true
+      - type: pipeline
+        branch_type: target_default
+        pipeline_sources:
+          including:
+            - merge_request_event
+${SCAN_EXECUTION_DEFAULT.actions}
+${SCAN_EXECUTION_DEFAULT.skip}
 `;
 
 export const mockSkipCiScanExecutionManifest = `scan_execution_policy:
   - name: ''
     description: ''
     enabled: true
-    rules:
-      - type: pipeline
-        branches:
-          - '*'
-    actions:
-      - scan: secret_detection
-        variables:
-          SECURE_ENABLE_LOCAL_CONFIGURATION: 'false'
+${SCAN_EXECUTION_DEFAULT.rules}
+${SCAN_EXECUTION_DEFAULT.actions}
     skip_ci:
       allowed: false
 `;
diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/rules_spec.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/rules_spec.js
index fc35b1c295b56d..ba1916eae67cc0 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/rules_spec.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/rules_spec.js
@@ -4,10 +4,14 @@ import App from 'ee/security_orchestration/components/policy_editor/app.vue';
 import { DEFAULT_ASSIGNED_POLICY_PROJECT } from 'ee/security_orchestration/constants';
 import BaseRuleComponent from 'ee/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component.vue';
 import ScheduleRuleComponent from 'ee/security_orchestration/components/policy_editor/scan_execution/rule/schedule_rule_component.vue';
-import { SCAN_EXECUTION_SCHEDULE_RULE } from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
+import {
+  SELECTION_CONFIG_CUSTOM,
+  SCAN_EXECUTION_SCHEDULE_RULE,
+} from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
+import BranchTypeSelector from 'ee/security_orchestration/components/policy_editor/scan_execution/rule/branch_type_selector.vue';
 import { DEFAULT_PROVIDE } from '../mocks/mocks';
 import { verify } from '../utils';
-import { mockScheduleScanExecutionManifest, mockScanExecutionManifest } from './mocks';
+import { mockScheduleScanExecutionManifest, mockAllBranchesScanExecutionManifest } from './mocks';
 
 describe('Scan execution policy rules', () => {
   let wrapper;
@@ -28,8 +32,13 @@ describe('Scan execution policy rules', () => {
     });
   };
 
+  const findEnforcementSelection = () => wrapper.findByTestId('enforcement-selection');
   const findScheduleRuleTypeDropDown = () => wrapper.findByTestId('rule-component-type');
 
+  const navigateToCustomMode = async () => {
+    await findEnforcementSelection().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+  };
+
   beforeEach(() => {
     jest.spyOn(urlUtils, 'getParameterByName').mockReturnValue('scan_execution_policy');
   });
@@ -39,12 +48,14 @@ describe('Scan execution policy rules', () => {
   });
 
   const findBaseRuleComponent = () => wrapper.findComponent(BaseRuleComponent);
+  const findBranchTypeSelector = () => wrapper.findComponent(BranchTypeSelector);
   const findScheduleRuleComponent = () => wrapper.findComponent(ScheduleRuleComponent);
   const findDisabledRuleSection = () => wrapper.findByTestId('disabled-rule');
 
   describe('pipeline', () => {
-    beforeEach(() => {
-      createWrapper();
+    beforeEach(async () => {
+      await createWrapper();
+      await navigateToCustomMode();
     });
 
     it('parses pipeline rule', async () => {
@@ -54,8 +65,9 @@ describe('Scan execution policy rules', () => {
         expect(findDisabledRuleSection().props('disabled')).toBe(false);
       };
 
+      await findBranchTypeSelector().vm.$emit('set-branch-type', 'all');
       await verify({
-        manifest: mockScanExecutionManifest,
+        manifest: mockAllBranchesScanExecutionManifest,
         verifyRuleMode,
         wrapper,
       });
@@ -63,8 +75,9 @@ describe('Scan execution policy rules', () => {
   });
 
   describe('schedule rule', () => {
-    beforeEach(() => {
-      createWrapper();
+    beforeEach(async () => {
+      await createWrapper();
+      await navigateToCustomMode();
     });
 
     it('parses schedule rule', async () => {
diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/split_view_layout_spec.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/split_view_layout_spec.js
index a8aff10252d5c3..826f5d8d987503 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/split_view_layout_spec.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/split_view_layout_spec.js
@@ -5,6 +5,7 @@ import App from 'ee/security_orchestration/components/policy_editor/app.vue';
 import AdvancedEditorToggle from 'ee/security_orchestration/components/policy_editor/advanced_editor_toggle.vue';
 import { DEFAULT_ASSIGNED_POLICY_PROJECT } from 'ee/security_orchestration/constants';
 import { POLICY_TYPE_COMPONENT_OPTIONS } from 'ee/security_orchestration/components/constants';
+import { SELECTION_CONFIG_CUSTOM } from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
 import { REPORT_TYPE_DAST } from '~/vue_shared/security_reports/constants';
 import EditorLayout from 'ee/security_orchestration/components/policy_editor/editor_layout.vue';
 import { DEFAULT_PROVIDE } from '../mocks/mocks';
@@ -27,10 +28,15 @@ describe('Split View', () => {
     });
   };
 
+  const findEnforcementSelection = () => wrapper.findByTestId('enforcement-selection');
   const findScanTypeSelector = () => wrapper.findByTestId('scan-type-selector');
   const findPolicyEditorLayout = () => wrapper.findComponent(EditorLayout);
   const findAdvancedEditorToggle = () => wrapper.findComponent(AdvancedEditorToggle);
 
+  const navigateToCustomMode = async () => {
+    await findEnforcementSelection().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+  };
+
   beforeEach(() => {
     jest
       .spyOn(urlUtils, 'getParameterByName')
@@ -39,14 +45,15 @@ describe('Split View', () => {
 
   describe('rendering', () => {
     let createPolicyObjectMock;
-    beforeEach(() => {
-      createWrapper({
+    beforeEach(async () => {
+      await createWrapper({
         provide: {
           glFeatures: { securityPoliciesSplitView: true },
           policyEditorEnabled: true,
           namespaceType: 'group',
         },
       });
+      await navigateToCustomMode();
 
       findAdvancedEditorToggle().vm.$emit('enable-advanced-editor', true);
 
diff --git a/spec/support/shared_examples/security/creating_scan_execution_policy_shared_examples.rb b/spec/support/shared_examples/security/creating_scan_execution_policy_shared_examples.rb
index 96c0d7d06092d4..e637e595690b17 100644
--- a/spec/support/shared_examples/security/creating_scan_execution_policy_shared_examples.rb
+++ b/spec/support/shared_examples/security/creating_scan_execution_policy_shared_examples.rb
@@ -48,7 +48,10 @@
 
   it "fails to create a policy without branch information for schedules" do
     fill_in _('Name'), with: 'Missing branch information'
-    select_from_listbox 'Schedules:', from: 'Triggers:'
+    page.find('span', text: 'Custom').click
+    within_testid('rule-0') do
+      select_from_listbox 'Schedules:', from: 'Triggers:'
+    end
     click_button _('Configure with a merge request')
     expect(page).to have_content('Policy cannot be enabled without branch information')
     expect(page).to have_current_path(path_to_scan_execution_policy_editor)
@@ -56,7 +59,11 @@
 
   it "fails to create a policy without branch information" do
     fill_in _('Name'), with: 'Scan execution policy'
-    fill_in _('Select branches'), with: ''
+    page.find('span', text: 'Custom').click
+    within_testid('rule-0') do
+      select_from_listbox 'specific protected branches', from: 'default branch'
+      fill_in _('Select branches'), with: ''
+    end
     click_button _('Configure with a merge request')
     expect(page).to have_content('Policy cannot be enabled without branch information')
     expect(page).to have_current_path(path_to_scan_execution_policy_editor)
-- 
GitLab


From 3a646a769a11cd384957820b17b46b8447348874 Mon Sep 17 00:00:00 2001
From: Alexander Turinske <aturinske@gitlab.com>
Date: Tue, 21 Oct 2025 09:51:00 -0600
Subject: [PATCH 4/4] Create reuseable test utility

- DRY up code
---
 .../policy_editor/scan_execution/actions_spec.js | 14 ++++----------
 .../policy_editor/scan_execution/rules_spec.js   | 16 ++++------------
 .../scan_execution/split_view_layout_spec.js     |  9 ++-------
 .../policy_editor/utils.js                       |  5 +++++
 4 files changed, 15 insertions(+), 29 deletions(-)

diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/actions_spec.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/actions_spec.js
index 705e677fd3f063..65c15af2a17e06 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/actions_spec.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/actions_spec.js
@@ -9,7 +9,6 @@ import {
   DEFAULT_ASSIGNED_POLICY_PROJECT,
   NAMESPACE_TYPES,
 } from 'ee/security_orchestration/constants';
-import { SELECTION_CONFIG_CUSTOM } from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
 import {
   REPORT_TYPE_SAST,
   REPORT_TYPE_SAST_IAC,
@@ -17,7 +16,7 @@ import {
   REPORT_TYPE_SECRET_DETECTION,
 } from '~/vue_shared/security_reports/constants';
 import { DEFAULT_PROVIDE } from '../mocks/mocks';
-import { verify } from '../utils';
+import { navigateToCustomMode, verify } from '../utils';
 import {
   createScanActionScanExecutionManifest,
   mockDastActionScanExecutionManifest,
@@ -55,21 +54,16 @@ describe('Scan execution policy actions', () => {
 
   const findCiVariablesSelectors = () => wrapper.findComponent(CiVariablesSelectors);
   const findDisabledActionSection = () => wrapper.findByTestId('disabled-action');
-  const findEnforcementSelection = () => wrapper.findByTestId('enforcement-selection');
   const findGroupDastProfileSelector = () => wrapper.findComponent(GroupDastProfileSelector);
   const findProjectDastProfileSelector = () => wrapper.findComponent(ProjectDastProfileSelector);
   const findRunnerTagsList = () => wrapper.findComponent(RunnerTagsList);
   const findScanFilterButton = () => wrapper.findByTestId('add-variable-button');
   const findScanTypeSelector = () => wrapper.findByTestId('scan-type-selector');
 
-  const navigateToCustomMode = async () => {
-    await findEnforcementSelection().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
-  };
-
   describe('non-dast scanners', () => {
     beforeEach(async () => {
       await createWrapper();
-      await navigateToCustomMode();
+      await navigateToCustomMode(wrapper);
     });
 
     it.each`
@@ -103,7 +97,7 @@ describe('Scan execution policy actions', () => {
       'selects secret detection dast as action',
       async ({ namespaceType, findDastSelector, manifest }) => {
         await createWrapper({ provide: { namespaceType } });
-        await navigateToCustomMode();
+        await navigateToCustomMode(wrapper);
 
         const verifyRuleMode = () => {
           expect(findScanTypeSelector().exists()).toBe(true);
@@ -122,7 +116,7 @@ describe('Scan execution policy actions', () => {
   describe('actions filters', () => {
     beforeEach(async () => {
       await createWrapper();
-      await navigateToCustomMode();
+      await navigateToCustomMode(wrapper);
     });
 
     it('selects variables filter', async () => {
diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/rules_spec.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/rules_spec.js
index ba1916eae67cc0..f74b4ee35410d9 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/rules_spec.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/rules_spec.js
@@ -4,13 +4,10 @@ import App from 'ee/security_orchestration/components/policy_editor/app.vue';
 import { DEFAULT_ASSIGNED_POLICY_PROJECT } from 'ee/security_orchestration/constants';
 import BaseRuleComponent from 'ee/security_orchestration/components/policy_editor/scan_execution/rule/base_rule_component.vue';
 import ScheduleRuleComponent from 'ee/security_orchestration/components/policy_editor/scan_execution/rule/schedule_rule_component.vue';
-import {
-  SELECTION_CONFIG_CUSTOM,
-  SCAN_EXECUTION_SCHEDULE_RULE,
-} from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
+import { SCAN_EXECUTION_SCHEDULE_RULE } from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
 import BranchTypeSelector from 'ee/security_orchestration/components/policy_editor/scan_execution/rule/branch_type_selector.vue';
 import { DEFAULT_PROVIDE } from '../mocks/mocks';
-import { verify } from '../utils';
+import { navigateToCustomMode, verify } from '../utils';
 import { mockScheduleScanExecutionManifest, mockAllBranchesScanExecutionManifest } from './mocks';
 
 describe('Scan execution policy rules', () => {
@@ -32,13 +29,8 @@ describe('Scan execution policy rules', () => {
     });
   };
 
-  const findEnforcementSelection = () => wrapper.findByTestId('enforcement-selection');
   const findScheduleRuleTypeDropDown = () => wrapper.findByTestId('rule-component-type');
 
-  const navigateToCustomMode = async () => {
-    await findEnforcementSelection().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
-  };
-
   beforeEach(() => {
     jest.spyOn(urlUtils, 'getParameterByName').mockReturnValue('scan_execution_policy');
   });
@@ -55,7 +47,7 @@ describe('Scan execution policy rules', () => {
   describe('pipeline', () => {
     beforeEach(async () => {
       await createWrapper();
-      await navigateToCustomMode();
+      await navigateToCustomMode(wrapper);
     });
 
     it('parses pipeline rule', async () => {
@@ -77,7 +69,7 @@ describe('Scan execution policy rules', () => {
   describe('schedule rule', () => {
     beforeEach(async () => {
       await createWrapper();
-      await navigateToCustomMode();
+      await navigateToCustomMode(wrapper);
     });
 
     it('parses schedule rule', async () => {
diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/split_view_layout_spec.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/split_view_layout_spec.js
index 826f5d8d987503..9ff97c30d4cd74 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/split_view_layout_spec.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/scan_execution/split_view_layout_spec.js
@@ -5,9 +5,9 @@ import App from 'ee/security_orchestration/components/policy_editor/app.vue';
 import AdvancedEditorToggle from 'ee/security_orchestration/components/policy_editor/advanced_editor_toggle.vue';
 import { DEFAULT_ASSIGNED_POLICY_PROJECT } from 'ee/security_orchestration/constants';
 import { POLICY_TYPE_COMPONENT_OPTIONS } from 'ee/security_orchestration/components/constants';
-import { SELECTION_CONFIG_CUSTOM } from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
 import { REPORT_TYPE_DAST } from '~/vue_shared/security_reports/constants';
 import EditorLayout from 'ee/security_orchestration/components/policy_editor/editor_layout.vue';
+import { navigateToCustomMode } from '../utils';
 import { DEFAULT_PROVIDE } from '../mocks/mocks';
 import { mockDastActionScanExecutionManifest } from './mocks';
 
@@ -28,15 +28,10 @@ describe('Split View', () => {
     });
   };
 
-  const findEnforcementSelection = () => wrapper.findByTestId('enforcement-selection');
   const findScanTypeSelector = () => wrapper.findByTestId('scan-type-selector');
   const findPolicyEditorLayout = () => wrapper.findComponent(EditorLayout);
   const findAdvancedEditorToggle = () => wrapper.findComponent(AdvancedEditorToggle);
 
-  const navigateToCustomMode = async () => {
-    await findEnforcementSelection().vm.$emit('input', SELECTION_CONFIG_CUSTOM);
-  };
-
   beforeEach(() => {
     jest
       .spyOn(urlUtils, 'getParameterByName')
@@ -53,7 +48,7 @@ describe('Split View', () => {
           namespaceType: 'group',
         },
       });
-      await navigateToCustomMode();
+      await navigateToCustomMode(wrapper);
 
       findAdvancedEditorToggle().vm.$emit('enable-advanced-editor', true);
 
diff --git a/ee/spec/frontend_integration/security_orchestration/policy_editor/utils.js b/ee/spec/frontend_integration/security_orchestration/policy_editor/utils.js
index a7fca0715bf067..6c56f411afb7d4 100644
--- a/ee/spec/frontend_integration/security_orchestration/policy_editor/utils.js
+++ b/ee/spec/frontend_integration/security_orchestration/policy_editor/utils.js
@@ -5,6 +5,7 @@ import {
   EDITOR_MODE_YAML,
 } from 'ee/security_orchestration/components/policy_editor/constants';
 import YamlEditor from 'ee/security_orchestration/components/yaml_editor.vue';
+import { SELECTION_CONFIG_CUSTOM } from 'ee/security_orchestration/components/policy_editor/scan_execution/constants';
 
 export const switchRuleMode = async (wrapper, mode, awaitPromise = true) => {
   await wrapper.findComponent(GlSegmentedControl).vm.$emit('input', mode);
@@ -55,3 +56,7 @@ export const createSppSubscriptionHandler = () =>
 
 export const removeGroupSetting = (yaml) =>
   yaml.replace('  block_group_branch_modification: true\n', '');
+
+export const navigateToCustomMode = async (wrapper) => {
+  await wrapper.findByTestId('enforcement-selection').vm.$emit('input', SELECTION_CONFIG_CUSTOM);
+};
-- 
GitLab