ISSUE-506MediumAccess and Authorization
Merge request settings are not compliant
Control: MR settings must be compliant· Config key: mergeRequestSettingsMustBeCompliant
📋 What is this?
The merge request settings in the project do not match the defined configuration, such as incorrect merge methods or merge options.
⚠️ Impact
Misconfigured merge request settings can lead to unauthorized code changes and security vulnerabilities.
🔧 How to fix
Update the merge request settings to match your Policy controls by ensuring proper merge methods and merge options.
✗ BeforeMR settings use merge commits and don't enforce squashing, violating the policy.
# GitLab project settings - ❌ MR settings violate the policy# Settings > Merge requests:## Merge method: Merge commit (policy requires: Fast-forward merge)# Squash commits: Not enforced (policy requires: Always squash)# Delete source branch: Not enforced## These settings create merge commits that clutter history# and allow inconsistent commit messages.✓ AfterMR settings match the policy: fast-forward merge and always squash.
# GitLab project settings - ✅ MR settings match the policy# Settings > Merge requests:## Merge method: Fast-forward merge# Squash commits: Always (required by policy)# Delete source branch: Enabled by default💡 Tips
- Fast-forward merge keeps a linear history, making it easier to bisect and revert.
- Enforcing squash commits ensures each feature is represented as a single atomic commit.
- Check your Plumber Platform policy for the exact merge and squash settings required.
⚙️ Configuration
This control is configured in .plumber.yaml under the gitlab section:
gitlab:
controls:
mergeRequestSettingsMustBeCompliant:
enabled: trueSee the CLI documentation for the full configuration reference. On Plumber Platform, the same key is used in your policy configuration.