MR Approvals

I currently have some policies to ask for MR approvals when something happen. But I don’t know why all my MRs get asked for approvals, no pipeline fails and I can’t see what (if anything) is found on each one.

My policies are

---
scan_execution_policy:
  - name: Executa Secret Detection, SAST e Dependency Scanning
    description: ""
    enabled: true
    rules:
      - type: pipeline
        branches:
          - "*"
    actions:
      - scan: secret_detection
        tags: []
      - scan: sast
        tags: []
      - scan: dependency_scanning
        tags: []
scan_result_policy:
  - name: License Scan
    description: ""
    enabled: true
    rules:
      - type: license_finding
        branches: []
        match_on_inclusion: false
        license_types:
          - MIT
        license_states:
          - newly_detected
    actions:
      - type: require_approval
        approvals_required: 1
        group_approvers_ids:
          - 13519293
  - name: Secret Detection
    description: "Secret Detection"
    enabled: true
    rules:
      - type: scan_finding
        branches: []
        scanners:
          - secret_detection
        vulnerabilities_allowed: 0
        severity_levels:
          - high
          - critical
          - medium
        vulnerability_states:
          - new_needs_triage
    actions:
      - type: require_approval
        approvals_required: 1
        group_approvers_ids:
          - 13519293
  - name: SAST
    description: "SAST"
    enabled: true
    rules:
      - type: scan_finding
        branches: []
        scanners:
          - sast
        vulnerabilities_allowed: 0
        severity_levels:
          - high
          - critical
          - medium
        vulnerability_states:
          - new_needs_triage
    actions:
      - type: require_approval
        approvals_required: 1
        group_approvers_ids:
          - 13519293
  - name: Dependency Scanning
    description: "Dependency Scanning"
    enabled: true
    rules:
      - type: scan_finding
        branches: []
        scanners:
          - dependency_scanning
        vulnerabilities_allowed: 0
        severity_levels:
          - high
          - critical
          - medium
        vulnerability_states:
          - new_needs_triage
    actions:
      - type: require_approval
        approvals_required: 1
        group_approvers_ids:
          - 13519293

My understanding is that using this configuration of mine the approvals should only be asked if anything is found, right?

So if all my MRs are asking for all approvals this means that always something is found? Where can I what is found?

Or am I doing something wrong?

Thank you.

Are all the security jobs running in the pipeline? All approvals are required until the pipeline is completed and only after the pipeline is completed and scan reports are available the approvals are updated.

The approvals are asked even after the pipelines finish and I cant find the reports for job. My artifacts dont show anything found.

When I send something to a MR it generates 2 separate pipelines. 1 runs on my MR branch (feat/footer for example) and another on the MR with the default branch. I really dont know if it is the intended effect or if this is the problem.

Running on my feat branch

image831×549 43 KB

Running on my MR

image889×543 43.3 KB