diff --git a/ee/app/models/ee/merge_request.rb b/ee/app/models/ee/merge_request.rb index 73485c3de2bf3f8b730f7ee3a0cf6c58d635f363..c72f8f27778da5e30cda52aac5f1830f051ea9ef 100644 --- a/ee/app/models/ee/merge_request.rb +++ b/ee/app/models/ee/merge_request.rb @@ -472,6 +472,9 @@ def synchronize_approval_rules_from_target_project project_rules = target_project.approval_rules.report_approver.includes(:users, :groups) project_rules.find_each do |project_rule| + next if !project.licensed_feature_available?(:security_orchestration_policies) && + project_rule.from_scan_result_policy? + project_rule.apply_report_approver_rules_to(self) do |rule_attributes| rule_attributes[:approvals_required] = 0 if project_rule.from_scan_result_policy? end diff --git a/ee/spec/models/merge_request_spec.rb b/ee/spec/models/merge_request_spec.rb index 3d7ea7c59e64dfd8389716b1421a7bc25c125505..e622be7fbb4e2610d493e8cfcba39b6596a8e3df 100644 --- a/ee/spec/models/merge_request_spec.rb +++ b/ee/spec/models/merge_request_spec.rb @@ -2188,12 +2188,29 @@ def create_mr(metrics_data = {}) subject { merge_request.synchronize_approval_rules_from_target_project } + before do + stub_licensed_features(security_orchestration_policies: true) + end + it 'resets security rules approvals but keeps code_coverage rule approvals' do subject expect(merge_request.approval_rules.map { |rule| [rule.report_type, rule.approvals_required] }) .to match_array([['license_scanning', 0], ['code_coverage', 2], ['scan_finding', 0], ['any_merge_request', 0]]) end + + context 'when the security orchestration policies feature not available' do + before do + stub_licensed_features(security_orchestration_policies: false) + end + + it 'does not create approval rules from scan result policies' do + subject + + expect(merge_request.approval_rules.map { |rule| [rule.report_type, rule.approvals_required] }) + .to match_array([['code_coverage', 2]]) + end + end end describe '#sync_project_approval_rules_for_policy_configuration' do diff --git a/ee/spec/services/ee/merge_requests/update_service_spec.rb b/ee/spec/services/ee/merge_requests/update_service_spec.rb index a7a92c3f8eb4b6f931f62d472585eaf836e95be6..eed436dc90e1cb9a1417f4153b5a7cb7a96bb8d3 100644 --- a/ee/spec/services/ee/merge_requests/update_service_spec.rb +++ b/ee/spec/services/ee/merge_requests/update_service_spec.rb @@ -553,6 +553,10 @@ def update_merge_request(opts) approvals_required: 0) end + before do + stub_licensed_features(security_orchestration_policies: true) + end + context 'with target branch change' do let(:opts) { { target_branch: 'feature-2' } } diff --git a/ee/spec/services/merge_requests/sync_report_approver_approval_rules_spec.rb b/ee/spec/services/merge_requests/sync_report_approver_approval_rules_spec.rb index a5f15d938f8c4d1ce96d983b2c75d672e1e18e1b..ac3e96fa728356361931cac71d23f9bfe7e584e4 100644 --- a/ee/spec/services/merge_requests/sync_report_approver_approval_rules_spec.rb +++ b/ee/spec/services/merge_requests/sync_report_approver_approval_rules_spec.rb @@ -12,7 +12,7 @@ using RSpec::Parameterized::TableSyntax before do - stub_licensed_features(report_approver_rules: true) + stub_licensed_features(report_approver_rules: true, security_orchestration_policies: true) end where(:default_name, :report_type) do @@ -115,6 +115,21 @@ end end + context 'when security_orchestration_policies feature is not available' do + let!(:license_compliance_project_rule) { create(:approval_project_rule, :license_scanning, project: merge_request.target_project) } + let!(:coverage_project_rule) { create(:approval_project_rule, :code_coverage, project: merge_request.target_project) } + + before do + stub_licensed_features(report_approver_rules: true, security_orchestration_policies: false) + + service.execute + end + + specify { expect(merge_request.reload.approval_rules.count).to be(1) } + specify { expect(merge_request.reload.approval_rules.coverage.count).to be(1) } + specify { expect(merge_request.reload.approval_rules.license_compliance.count).to be(0) } + end + context 'when coverage_check_approval_rule is disabled' do before do stub_licensed_features(coverage_check_approval_rule: false)