Tutorial: Set up a merge request approval policy

This tutorial shows you how to create and configure a merge request approval policy. These policies can be set to take action based on scan results. For example, in this tutorial, you’ll set up a policy that requires approval from two specified users if a vulnerability is detected in a merge request.

To set up a merge request approval policy:

1. Create a test project.
2. Add a merge request approval policy.
3. Test the merge request approval policy.

Before you begin

• The namespace you use for this tutorial must contain a minimum of three users, including your own. If you don’t have two other users, you must first create them. For details, see Creating users.
• You need permission to create new projects in an existing group.

Create a test project

1. In the upper-right corner, select Create new ( ) and New project/repository.
2. Select Create blank project.
3. Complete the fields.
   • Project name: sast-scan-result-policy.
   • Select the Enable Static Application Security Testing (SAST) checkbox.
4. Select Create project.
5. To protect the default branch:
   1. In the top bar, select Search or go to and enter sast-scan-result-policy.
   2. In the left sidebar, select Settings > Repository.
   3. Expand Branch rules.
   4. Select Add branch rule > Branch name or pattern.
   5. From the dropdown list, search for and select main (or your default branch), then select Create branch rule.
   6. From the Allowed to merge section, select Edit, set it to Maintainers, then select Save changes.
   7. From the Allowed to push and merge section, select Edit, set it to No one, then select Save changes.

Add a merge request approval policy

Next, you’ll add a merge request approval policy to your test project:

1. In the top bar, select Search or go to and find the sast-scan-result-policy project.

2. Select Secure > Policies.

3. Select New policy.

4. In Merge request approval policy, select Select policy.

5. Complete the fields.

   • Name: sast-scan-result-policy
   • Policy status: Enabled

6. Select Add new rule and configure the rule:

   • For scan type, select security scan with SAST.
   • For the target, select all protected branches with no exceptions.
   • For the vulnerability count, select more than and enter 0.

7. Under Global Settings, configure severity and status:

   • Severity is: All severity levels
   • Status: New + All vulnerability states

8. Set Actions to the following:

   THEN Require approval from | 2 | of the following approvers:

9. Select two users.

10. Select Configure with a merge request.

    The application creates a new project to store the policies linked to it, and creates a merge request to define the policy.

11. Select Merge.

12. In the top bar, select Search or go to and find the sast-scan-result-policy project.

13. Select Secure > Policies.

    You can see the list of policies added in the previous steps.

Test the merge request approval policy

Nice work, you’ve created a merge request approval policy. To test it, create some vulnerabilities and check the result:

1. In the top bar, select Search or go to and find the sast-scan-result-policy project.

2. In the left sidebar, select Code > Repository.

3. From the Add ( ) dropdown list, select New file.

4. In the Filename field enter main.ts.

5. In the file’s content, copy the following:

   // Non-literal require - tsr-detect-non-literal-require
   var lib: String = 'fs'
   require(lib)
   
   // Eval with variable - tsr-detect-eval-with-expression
   var myeval: String = 'console.log("Hello.");';
   eval(myeval);
   
   // Unsafe Regexp - tsr-detect-unsafe-regexp
   const regex: RegExp = /(x+x+)+y/;
   
   // Non-literal Regexp - tsr-detect-non-literal-regexp
   var myregexpText: String = "/(x+x+)+y/";
   var myregexp: RegExp = new RegExp(myregexpText);
   myregexp.test("(x+x+)+y");
   
   // Markup escaping disabled - tsr-detect-disable-mustache-escape
   var template: Object = new Object;
   template.escapeMarkup = false;
   
   // Detects HTML injections - tsr-detect-html-injection
   var element: Element =  document.getElementById("mydiv");
   var content: String = "mycontent"
   Element.innerHTML = content;
   
   // Timing attack - tsr-detect-possible-timing-attacks
   var userInput: String = "Jane";
   var auth: String = "Jane";
   if (userInput == auth) {
     console.log(userInput);
   }

6. In the Commit message field, enter Add vulnerable file.

7. In the Target Branch field, enter test-branch.

8. Select Commit changes. The New merge request form opens.

9. Select Create merge request.

10. In the new merge request, select Create merge request.

    Wait for the pipeline to complete. This could be a few minutes.

The merge request Reports tab confirms that security scanning detected one potential vulnerability. As defined in the merge request approval policy, the merge request is blocked and waiting for approval.

You now know how to set up and use merge request approval policies to catch vulnerabilities!