ISSUE-503HighAccess and Authorization

Merge request approval settings are not compliant

Control: MR approval settings must be compliant· Config key: mergeRequestApprovalSettingsMustBeCompliant

📋 What is this?

The project's merge request approval settings do not meet the expectations you configured. Each expectation is optional: a setting you leave unset is not checked.

⚠️ Impact

Approval settings apply above every approval rule. When authors or committers can approve, when rules can be overridden inside a merge request, or when approvals survive new commits, the review requirement can be satisfied without anyone reviewing the code that actually ships.

🔧 How to fix

Update the project's approval settings under Settings > Merge requests to match the expectations in your configuration.

✗ BeforeApproval settings allow the author to approve their own MR and don't reset on new commits.

# GitLab project settings - ❌ Approval settings violate the policy
# Settings > Merge requests > Approvals:
#
#   Prevent approval by author:                  false ← Author can approve own MR
#   Prevent approvals by users who add commits:  false
#   Remove all approvals when commits are added: false
#
# These settings allow the MR author to approve their own changes,
# and approvals remain valid even after new commits are pushed.

✓ AfterApproval settings prevent self-approval and reset on new commits.

# GitLab project settings - ✅ Approval settings match the policy
# Settings > Merge requests > Approvals:
#
#   Prevent approval by author:                  true
#   Prevent approvals by users who add commits:  true
#   Remove all approvals when commits are added: true

💡 Tips

Merge request approval settings require GitLab Premium or Ultimate. On Free the API returns defaults rather than an error, so the control cannot tell the tier apart from a genuinely unlocked project. It ships disabled for that reason. Enable it only on Premium or Ultimate projects.
Set your expectations in .plumber.yaml under mergeRequestApprovalSettingsMustBeCompliant. Each one is optional: preventApprovalByAuthor, preventApprovalsByCommitters, preventEditingApprovalRulesInMR and requireReAuthToApprove are only checked when set to true.
behaviorWhenCommitIsAdded is a minimum on the ladder keep_approvals < remove_approvals_by_code_owners < remove_all_approvals, so a stricter project than you asked for still passes.
Enable 'Prevent approval by author' to ensure code is reviewed by someone other than the author.
These settings can also be enforced at the group level for consistency.

⚙️ Configuration

This control is configured in .plumber.yaml under the gitlab section:

gitlab:
  controls:
    mergeRequestApprovalSettingsMustBeCompliant:
      enabled: true

See the CLI documentation for the full configuration reference. On Plumber Platform, the same key is used in your policy configuration.

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

⚙️ Configuration

🔗 Related issues