diff --git a/data/deprecations/16-9-excluded-analyzer-variable-behavior-change.yml b/data/deprecations/16-9-excluded-analyzer-variable-behavior-change.yml new file mode 100644 index 0000000000000000000000000000000000000000..ab34361a1436123f8770a188252a8437fd000884 --- /dev/null +++ b/data/deprecations/16-9-excluded-analyzer-variable-behavior-change.yml @@ -0,0 +1,13 @@ +- title: "Scan execution policies enforcing scans with an `_EXCLUDED_ANALYZERS` variable will override project variables" # (required) Clearly explain the change, or planned change. For example, "The `confidential` field for a `Note` is deprecated" or "CI/CD job names will be limited to 250 characters." + removal_milestone: "17.0" # (required) The milestone when this feature is planned to be removed + announcement_milestone: "16.9" # (required) The milestone when this feature was first announced as deprecated. + breaking_change: true # (required) Change to false if this is not a breaking change. + reporter: g.hickman # (required) GitLab username of the person reporting the change + stage: govern # (required) String value of the stage that the feature was created in. e.g., Growth + issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/424513 # (required) Link to the deprecation issue in GitLab + body: | # (required) Do not modify this line, instead modify the lines below. + After delivering and verifying [Enforce SEP variables with the highest precedence](https://gitlab.com/gitlab-org/gitlab/-/issues/424028), we have discovered unintended behavior, allowing users to set `_EXCLUDED_PATHS` in pipeline configuration and preventing them from setting `_EXCLUDED_ANALYZERS` in both policy and pipeline configuration. + + To ensure proper enforcement of scan execution variables, when an `_EXCLUDED_ANALYZERS` or `_EXCLUDED_PATHS` variables are specified for a scan execution policy using the GitLab scan action, the variable will now override any project variables defined for excluded analyzers. + + Users may enable the feature flag to enforce this behavior before 17.0. In 17.0, projects leveraging the `_EXCLUDED_ANALYZERS`/`_EXCLUDED_PATHS` variable where a scan execution policy with the variable is defined will be overridden by default. diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md index a6e4a3f0ffa41b5f1da51c3388efa62a0ea3d07b..a3ae607128f428696731c1bb0aeb5c502cca1cba 100644 --- a/doc/update/deprecations.md +++ b/doc/update/deprecations.md @@ -1640,6 +1640,24 @@ If you applied customizations to the removed analyzers, or if you currently disa <div class="deprecation breaking-change" data-milestone="17.0"> +### Scan execution policies enforcing scans with an `_EXCLUDED_ANALYZERS` variable will override project variables + +<div class="deprecation-notes"> +- Announced in GitLab <span class="milestone">16.9</span> +- Removal in GitLab <span class="milestone">17.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change)) +- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/424513). +</div> + +After delivering and verifying [Enforce SEP variables with the highest precedence](https://gitlab.com/gitlab-org/gitlab/-/issues/424028), we have discovered unintended behavior, allowing users to set `_EXCLUDED_PATHS` in pipeline configuration and preventing them from setting `_EXCLUDED_ANALYZERS` in both policy and pipeline configuration. + +To ensure proper enforcement of scan execution variables, when an `_EXCLUDED_ANALYZERS` or `_EXCLUDED_PATHS` variables are specified for a scan execution policy using the GitLab scan action, the variable will now override any project variables defined for excluded analyzers. + +Users may enable the feature flag to enforce this behavior before 17.0. In 17.0, projects leveraging the `_EXCLUDED_ANALYZERS`/`_EXCLUDED_PATHS` variable where a scan execution policy with the variable is defined will be overridden by default. + +</div> + +<div class="deprecation breaking-change" data-milestone="17.0"> + ### Secure analyzers major version update <div class="deprecation-notes">