diff --git a/doc/user/project/merge_requests/approvals/rules.md b/doc/user/project/merge_requests/approvals/rules.md index 6e8fe0558807b7f35449e464ac62b64886a9f0b3..214455c83766d42e0e98a7e9faaaf778de981694 100644 --- a/doc/user/project/merge_requests/approvals/rules.md +++ b/doc/user/project/merge_requests/approvals/rules.md @@ -114,16 +114,23 @@ more of these: - The project. - The project's immediate parent [group](#group-approvers). -- A group that has access to the project via a [share](../../members/share_project_with_groups.md). +- A group that has been [shared](../../members/share_project_with_groups.md) with the project. - A [group added as approvers](#group-approvers). -The following users can approve merge requests if they have Developer or -higher [permissions](../../../permissions.md): +The following users can approve merge requests if they have at least the Developer role: - Users added as approvers at the project or merge request level. - Users who are [Code owners](#code-owners-as-eligible-approvers) of the files changed in the merge request. +Users with the Reporter role can approve only if both of the following are true: + +- The users are part of a group that has been [shared](../../members/share_project_with_groups.md) with the project. + The group must have at least the Reporter role. +- The group has been added as merge request approvers. + +For detailed instructions, see [Merge request approval segregation of duties](#merge-request-approval-segregation-of-duties). + To show who has participated in the merge request review, the Approvals widget in a merge request displays a **Commented by** column. This column lists eligible approvers who commented on the merge request. It helps authors and reviewers identify who to @@ -183,21 +190,24 @@ for protected branches. ## Merge request approval segregation of duties -> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/40491) in GitLab 13.4. -> - Moved to GitLab Premium in 13.9. - You may have to grant users with the Reporter role permission to approve merge requests before they can merge to a protected branch. Some users (like managers) may not need permission to push or merge code, but still need -oversight on proposed work. To enable approval permissions for these users without -granting them push access: +oversight on proposed work. + +Prerequisites: + +- You must select a specific branch, as this method does **not** work with `All Branches` or `All protected branches` settings. +- The shared group must be added to an approval rule and not individual users, even when the added user is part of the group. + +To enable approval permissions for these users without granting them push access: 1. [Create a protected branch](../../protected_branches.md) 1. [Create a new group](../../../group/index.md#create-a-group). 1. [Add the user to the group](../../../group/index.md#add-users-to-a-group), and select the Reporter role for the user. 1. [Share the project with your group](../../members/share_project_with_groups.md#share-a-project-with-a-group), - based on the Reporter role. + with at least the Reporter role. 1. Go to your project and select **Settings > Merge requests**. 1. In the **Merge request approvals** section, scroll to **Approval rules**, and either: - For a new rule, select **Add approval rule** and target the protected branch.