Feat/add gitlab mr approval controls

.plumber.yaml

@@ -192,6 +192,25 @@ gitlab:
       # Minimum access level required to push (0=No one, 30=Developer, 40=Maintainer)
       minPushAccessLevel: 40
     # ===========================================
+    # MR approval rules must require a minimum number of approvals
+    # ===========================================
+    # Flags approval rules covering all protected branches that require fewer
+    # approvals than the minimum below. GitLab Premium/Ultimate feature; on
+    # Free the approvals API returns no rules, so it passes vacuously. A
+    # genuine 401/403 reports not-evaluable.
+    mergeRequestApprovalRulesMustRequireMinimumApprovals:
+      enabled: true
+      minimumRequiredApprovals: 1
+    # ===========================================
+    # MR approval rules must cover all protected branches
+    # ===========================================
+    # Flags a project where no approval rule applies to all protected branches
+    # (explicit "all protected branches" target only). GitLab Premium/Ultimate
+    # feature; on Free the approvals API returns empty, so this fires. A genuine
+    # 401/403 reports not-evaluable.
+    mergeRequestApprovalRulesMustCoverAllProtectedBranches:
+      enabled: true
+    # ===========================================
     # Pipeline must not include hardcoded jobs
     # ===========================================
     # Detects CI/CD jobs that are defined directly in the .gitlab-ci.yml file

README.md

@@ -313,6 +313,7 @@ Plumber ships controls for:
 
 - container image pinning and authorized sources
 - branch protection
+- GitLab merge request approval rules (minimum approvals, coverage of all protected branches)
 - GitLab CI/CD settings variables that must be protected and masked
 - unverified script execution (`curl | bash`, `base64 -d | bash`, etc.)
 - Docker-in-Docker

cmd/analyze_shared.go

@@ -104,6 +104,7 @@ func outputTextWithProvider(p provider.Provider, result *control.AnalysisResult,
 	// real) and drop the green stat blocks (#220).
 	renderFindingGroups(filterGroupsForDegraded(groups, result.DataCollectionDegraded))
 	renderWarnings(result.Warnings)
+	renderApprovalRulesTierCaveat(result)
 
 	printSectionHeader("Summary")
 	fmt.Println()

cmd/init.go

@@ -27,7 +27,7 @@ const (
 
 	catImages      = "Container image security (tags, trusted registries)"
 	catComposition = "Pipeline composition (includes, scripts, security jobs, DinD)"
-	catAccess      = "Access control (branch protection)"
+	catAccess      = "Access control (branch protection, MR approvals)"
 	catVariables   = "Variable security (settings variables, debug trace, unsafe expansion)"
 
 	// GitLab-applicable composition checks (existing).
@@ -197,6 +197,12 @@ type initWizardState struct {
 	BranchMinMergeAccessLevel             string
 	BranchMinPushAccessLevel              string
 
+	// mergeRequestApprovalRulesMustRequireMinimumApprovals /
+	// ...MustCoverAllProtectedBranches (GitLab-only, catAccess).
+	MRApprovalMinEnabled      bool
+	MRApprovalMinCount        string
+	MRApprovalCoverAllEnabled bool
+
 	// pipelineMustNotEnableDebugTrace
 	DebugForbiddenVariablesMultiline string
 
@@ -492,6 +498,28 @@ func (st *initWizardState) askAccessQuestions() error {
 		}, &st.BranchMinPushAccessLevel); err != nil {
 			return err
 		}
+		if err := survey.AskOne(&survey.Confirm{
+			Message: "Flag MR approval rules that require fewer than a minimum number of approvals? (GitLab)",
+			Help:    "Checks approval rules covering all protected branches against a minimum. Requires a token that can read approval rules (a premium feature). Ships off by default.",
+			Default: defaultMRApprovalMinEnabled(),
+		}, &st.MRApprovalMinEnabled); err != nil {
+			return err
+		}
+		if st.MRApprovalMinEnabled {
+			if err := survey.AskOne(&survey.Input{
+				Message: "Minimum approvals a rule covering all protected branches must require (GitLab)",
+				Default: fmt.Sprintf("%d", defaultMRApprovalMinCount()),
+			}, &st.MRApprovalMinCount); err != nil {
+				return err
+			}
+		}
+		if err := survey.AskOne(&survey.Confirm{
+			Message: "Flag projects where no MR approval rule covers all protected branches? (GitLab)",
+			Help:    "A protected branch with no covering approval rule can be merged with no required approval. Ships off by default.",
+			Default: defaultMRApprovalCoverAllEnabled(),
+		}, &st.MRApprovalCoverAllEnabled); err != nil {
+			return err
+		}
 	}
 	if hasProvider(st, "github") {
 		if err := survey.AskOne(&survey.Confirm{
@@ -781,6 +809,30 @@ var embeddedDefault = sync.OnceValue(func() *configuration.PlumberConfig {
 func defaultGitLabControls() configuration.ControlsConfig { return embeddedDefault().GitLab.Controls }
 func defaultGitHubControls() configuration.ControlsConfig { return embeddedDefault().GitHub.Controls }
 
+// defaultMRApproval* source the wizard's Confirm/Input defaults for the
+// merge-request approval-rule controls from the shipped default, so the
+// prompts and the zero-config baseline cannot drift.
+func defaultMRApprovalMinEnabled() bool {
+	if c := defaultGitLabControls().MergeRequestApprovalRulesMustRequireMinimumApprovals; c != nil {
+		return c.IsEnabled()
+	}
+	return false
+}
+
+func defaultMRApprovalMinCount() int {
+	if c := defaultGitLabControls().MergeRequestApprovalRulesMustRequireMinimumApprovals; c != nil && c.MinimumRequiredApprovals != nil {
+		return *c.MinimumRequiredApprovals
+	}
+	return 1
+}
+
+func defaultMRApprovalCoverAllEnabled() bool {
+	if c := defaultGitLabControls().MergeRequestApprovalRulesMustCoverAllProtectedBranches; c != nil {
+		return c.IsEnabled()
+	}
+	return false
+}
+
 // defaultCicdVariablesProtectedEnabled / ...Masked source the wizard's
 // Confirm defaults from the shipped default (both ship disabled), so the
 // wizard prompt and the zero-config baseline cannot drift.
@@ -1034,6 +1086,15 @@ func (st *initWizardState) applyAccessControls(gl, gh *configuration.ProviderCon
 			MinMergeAccessLevel:       intPtrInit(parseIntInit(st.BranchMinMergeAccessLevel, 30)),
 			MinPushAccessLevel:        intPtrInit(parseIntInit(st.BranchMinPushAccessLevel, 40)),
 		}
+		if st.MRApprovalMinEnabled {
+			gl.Controls.MergeRequestApprovalRulesMustRequireMinimumApprovals = &configuration.MRApprovalRulesMinApprovalsControlConfig{
+				Enabled:                  boolPtrInit(true),
+				MinimumRequiredApprovals: intPtrInit(parseIntInit(st.MRApprovalMinCount, defaultMRApprovalMinCount())),
+			}
+		}
+		if st.MRApprovalCoverAllEnabled {
+			gl.Controls.MergeRequestApprovalRulesMustCoverAllProtectedBranches = &configuration.EnabledOnlyControlConfig{Enabled: boolPtrInit(true)}
+		}
 	}
 	if gh != nil {
 		// GitHub branch-protection ignores access-level fields.

cmd/init_mr_approval_test.go

@@ -0,0 +1,59 @@
+package cmd
+
+import (
+	"testing"
+
+	"github.com/getplumber/plumber/configuration"
+)
+
+// applyAccessControls maps the three MR-approval wizard answers onto GitLab
+// config. A field mix-up (wrong parse target, inverted Enabled, or one control
+// writing the other's field) would silently emit a wrong .plumber.yaml from
+// `plumber config init` with no drift guard, since both controls ship disabled.
+// This pins the mapping.
+func TestApplyAccessControls_MRApprovalMapping(t *testing.T) {
+	t.Run("min-approvals: enabled with the parsed count", func(t *testing.T) {
+		gl := &configuration.ProviderConfig{}
+		(&initWizardState{MRApprovalMinEnabled: true, MRApprovalMinCount: "3"}).applyAccessControls(gl, nil)
+		c := gl.Controls.MergeRequestApprovalRulesMustRequireMinimumApprovals
+		if c == nil || !c.IsEnabled() {
+			t.Fatal("min-approvals control should be enabled")
+		}
+		if c.MinimumRequiredApprovals == nil || *c.MinimumRequiredApprovals != 3 {
+			t.Fatalf("MinimumRequiredApprovals = %v, want 3", c.MinimumRequiredApprovals)
+		}
+		if gl.Controls.MergeRequestApprovalRulesMustCoverAllProtectedBranches != nil {
+			t.Fatal("cover-all must stay unset when only min-approvals was chosen (field mix-up)")
+		}
+	})
+	t.Run("cover-all: enabled, min-approvals untouched", func(t *testing.T) {
+		gl := &configuration.ProviderConfig{}
+		(&initWizardState{MRApprovalCoverAllEnabled: true}).applyAccessControls(gl, nil)
+		if c := gl.Controls.MergeRequestApprovalRulesMustCoverAllProtectedBranches; c == nil || !c.IsEnabled() {
+			t.Fatal("cover-all control should be enabled")
+		}
+		if gl.Controls.MergeRequestApprovalRulesMustRequireMinimumApprovals != nil {
+			t.Fatal("min-approvals must stay unset when only cover-all was chosen (field mix-up)")
+		}
+	})
+	t.Run("neither approval control set when neither chosen", func(t *testing.T) {
+		gl := &configuration.ProviderConfig{}
+		(&initWizardState{}).applyAccessControls(gl, nil)
+		if gl.Controls.MergeRequestApprovalRulesMustRequireMinimumApprovals != nil || gl.Controls.MergeRequestApprovalRulesMustCoverAllProtectedBranches != nil {
+			t.Fatal("no approval controls should be set when neither was chosen")
+		}
+	})
+	// The wizard defaults must come from the embedded shipped default (both ship
+	// disabled), so the prompt defaults and the zero-config baseline cannot drift.
+	t.Run("defaults sourced from the embedded shipped default", func(t *testing.T) {
+		if defaultMRApprovalMinEnabled() {
+			t.Error("defaultMRApprovalMinEnabled should be false (ships disabled)")
+		}
+		if defaultMRApprovalCoverAllEnabled() {
+			t.Error("defaultMRApprovalCoverAllEnabled should be false (ships disabled)")
+		}
+		if got := defaultMRApprovalMinCount(); got < 1 {
+			t.Errorf("defaultMRApprovalMinCount = %d, want >= 1 (the shipped minimum)", got)
+		}
+	})
+}

cmd/legacy_json.go

@@ -98,10 +98,32 @@ func _withControlMeta(block any, e control.ControlEntry, result *control.Analysi
 	if m, ok := block.(map[string]any); ok {
 		m["controlName"] = e.ControlName
 		m["status"] = control.StatusFor(e, result, findingCount)
+		if result != nil && result.ApprovalRulesTierCaveat && isApprovalRuleControl(e.ControlName) {
+			// Structured so a consumer can key on it: the approvals API returned
+			// no rules, which on GitLab Free means the feature is unavailable
+			// (the API 200-empties) rather than a real misconfiguration.
+			m["tierCaveat"] = map[string]any{
+				"reason":       "no-approval-rules-returned",
+				"requiresTier": "premium_or_ultimate",
+				"message":      approvalRulesTierCaveatMessage,
+			}
+		}
 	}
 	return block
 }
 
+// approvalRulesTierCaveatMessage explains the Premium/Ultimate requirement for
+// the MR approval-rule controls when the approvals API returned no rules.
+// Shared by the terminal caveat (render_details.go) and the JSON tierCaveat.
+const approvalRulesTierCaveatMessage = "MR approval rules are a GitLab Premium/Ultimate feature. Disable these controls if you don't have GitLab Premium or Ultimate."
+
+// isApprovalRuleControl reports whether a control name is one of the two
+// GitLab MR approval-rule controls the tier caveat applies to.
+func isApprovalRuleControl(name string) bool {
+	return name == "mergeRequestApprovalRulesMustRequireMinimumApprovals" ||
+		name == "mergeRequestApprovalRulesMustCoverAllProtectedBranches"
+}
+
 // buildLegacyResult routes a control entry to its legacy JSON
 // builder and returns the (jsonKey, block) pair.
 func buildLegacyResult(e control.ControlEntry, result *control.AnalysisResult, pc *configuration.PlumberConfig, findings []opaengine.Finding) (string, any) {
@@ -144,6 +166,10 @@ func buildLegacyResult(e control.ControlEntry, result *control.AnalysisResult, p
 		return "jobVariablesOverrideResult", buildJobVariablesOverrideBlock(common, result, findings)
 	case "pipelineMustNotUseDockerInDocker":
 		return "dockerInDockerResult", buildDockerInDockerBlock(common, result, findings)
+	case "mergeRequestApprovalRulesMustRequireMinimumApprovals":
+		return "mrApprovalRulesMinApprovalsResult", buildMRApprovalRulesMinApprovalsBlock(common, findings)
+	case "mergeRequestApprovalRulesMustCoverAllProtectedBranches":
+		return "mrApprovalRulesCoverAllBranchesResult", buildMRApprovalRulesCoverAllBranchesBlock(common, findings)
 	case "cicdVariablesMustBeProtected":
 		return "cicdVariablesProtectedResult", buildCicdVariablesProtectedBlock(common, result, findings)
 	case "cicdVariablesMustBeMasked":
@@ -152,6 +178,38 @@ func buildLegacyResult(e control.ControlEntry, result *control.AnalysisResult, p
 	return "", nil
 }
 
+// buildMRApprovalRulesMinApprovalsBlock and
+// buildMRApprovalRulesCoverAllBranchesBlock emit the legacy JSON blocks for the
+// merge-request approval-rule controls. The findings are settings-level (no
+// file/job), so each issue carries the approval-rule identity (approvalRuleId)
+// plus the ruleName / approvalsRequired / minApprovalsRequired data that
+// projectFindings preserves from f.Data.
+func buildMRApprovalRulesMinApprovalsBlock(c legacyCommon, findings []opaengine.Finding) map[string]any {
+	return map[string]any{
+		"issues": projectFindings(findings, "job"),
+		"metrics": map[string]any{
+			"rulesBelowMinimum": len(findings),
+		},
+		"version":   "0.1.0",
+		"ciValid":   c.CiValid,
+		"ciMissing": c.CiMissing,
+		"skipped":   c.Skipped,
+	}
+}
+
+func buildMRApprovalRulesCoverAllBranchesBlock(c legacyCommon, findings []opaengine.Finding) map[string]any {
+	return map[string]any{
+		"issues": projectFindings(findings, "job"),
+		"metrics": map[string]any{
+			"allProtectedBranchesRuleMissing": len(findings),
+		},
+		"version":   "0.1.0",
+		"ciValid":   c.CiValid,
+		"ciMissing": c.CiMissing,
+		"skipped":   c.Skipped,
+	}
+}
+
 // buildCicdVariablesProtectedBlock and buildCicdVariablesMaskedBlock emit the
 // legacy JSON blocks for the settings-variable controls. The findings are
 // settings-level (no file/job), so each issue carries the variable identity