Merge request approval rule is below the minimum level of approvals required
Control: MR approval rules must require a minimum number of approvals· Config key: mergeRequestApprovalRulesMustRequireMinimumApprovals
📋 What is this?
The merge request approval rule is configured with fewer approvers than the minimum required by your Policy controls.
⚠️ Impact
Having insufficient approvals can lead to unreviewed code being merged, increasing the risk of introducing bugs, security vulnerabilities, or changes that violate your policy.
🔧 How to fix
Increase the minimum number of approvals required in the merge request approval rule to meet or exceed the minimum number required by your Policy controls.
# GitLab project settings: ❌ Insufficient approvals# Settings > Merge requests > Approval rules:## Rule name: Security Team# Eligible approvers: Security Team (5 members)# Approvals required: 1 ← Below minimum (2 required by policy)# GitLab project settings: ✅ Sufficient approvals configured# Settings > Merge requests > Approval rules:## Rule name: Security Team# Eligible approvers: Security Team (5 members)# Approvals required: 2 ← Meets minimum requirement💡 Tips
- Set the minimum in
.plumber.yamlundermergeRequestApprovalRulesMustRequireMinimumApprovals.minimumRequiredApprovals. - Consider requiring different approval counts for different branch patterns (e.g., more for
main). - Combine with code owner approvals for critical areas of your codebase.
⚙️ Configuration
This control is configured in .plumber.yaml under the gitlab section:
gitlab:
controls:
mergeRequestApprovalRulesMustRequireMinimumApprovals:
enabled: trueSee the CLI documentation for the full configuration reference. On Plumber Platform, the same key is used in your policy configuration.