diff --git a/ee/app/models/ee/merge_request.rb b/ee/app/models/ee/merge_request.rb index ef5db8022a81bb38eaad64aefa39b027c77bb9b7..a2a2d9b06232cb16d1130f1c14a2ac12e6b8515d 100644 --- a/ee/app/models/ee/merge_request.rb +++ b/ee/app/models/ee/merge_request.rb @@ -755,6 +755,7 @@ def duo_code_review_progress_note def preserve_open_policy_dismissals! return unless merged? + return unless target_branch == target_project.default_branch policy_dismissals.open.find_each(&:preserve!) end diff --git a/ee/spec/models/merge_request_spec.rb b/ee/spec/models/merge_request_spec.rb index 3983e2b561f7a855fe204e21404e4ea19c33f281..d87e56270fe264df0c2858b0a8ce357568112cb8 100644 --- a/ee/spec/models/merge_request_spec.rb +++ b/ee/spec/models/merge_request_spec.rb @@ -3929,8 +3929,18 @@ def stub_foss_conditions_met end describe '#preserve_open_policy_dismissals!' do - let_it_be(:project) { create(:project) } - let_it_be(:merge_request) { create(:merge_request, :merged, source_project: project, target_project: project) } + let_it_be(:project) { create(:project, :repository) } + let_it_be(:merge_request) do + create( + :merge_request, + :merged, + source_project: + project, + target_project: project, + source_branch: 'feature-branch', + target_branch: project.default_branch + ) + end subject(:preserve_open_policy_dismissals) { merge_request.preserve_open_policy_dismissals! } @@ -3963,6 +3973,19 @@ def stub_foss_conditions_met .not_to change { open_dismissal.reload.status } end end + + context 'when merge request was not merged into the default branch' do + let_it_be(:merge_request) do + create(:merge_request, :merged, source_project: project, target_project: project, target_branch: 'feature') + end + + let_it_be(:open_dismissal) { create(:policy_dismissal, merge_request: merge_request, project: project) } + + it 'returns early without processing dismissals' do + expect { preserve_open_policy_dismissals } + .not_to change { open_dismissal.reload.status } + end + end end describe '#all_target_branch_pipelines' do diff --git a/ee/spec/workers/security/scan_result_policies/cleanup_merge_request_violations_worker_spec.rb b/ee/spec/workers/security/scan_result_policies/cleanup_merge_request_violations_worker_spec.rb index 901665b7023152ff012009d21ef1b851506ee74d..b9378b66659d545016ed1c87845d3ace8946f9c2 100644 --- a/ee/spec/workers/security/scan_result_policies/cleanup_merge_request_violations_worker_spec.rb +++ b/ee/spec/workers/security/scan_result_policies/cleanup_merge_request_violations_worker_spec.rb @@ -3,7 +3,10 @@ require 'spec_helper' RSpec.describe Security::ScanResultPolicies::CleanupMergeRequestViolationsWorker, '#perform', feature_category: :security_policy_management do - let_it_be(:merge_request) { create(:merge_request, :merged) } + let_it_be(:project) { create(:project, :repository) } + let_it_be(:merge_request) do + create(:merge_request, :merged, source_branch: 'feature-branch', target_branch: project.default_branch) + end let_it_be_with_reload(:merge_request_violation) do create(:scan_result_policy_violation, :running, merge_request: merge_request)