Description:

This control ensures that merge requests cannot be merged into protected branches until the configured Continuous Integration (CI) pipeline has completed successfully. The CI pipeline validates code changes through automated build, test, and verification processes before integration.


Rationale:

Requiring a successful CI pipeline before merge helps prevent defective, unstable, or non-compliant code from being introduced into protected branches. Automated validation improves software quality, reduces deployment risks, and ensures that code changes meet organizational standards before being merged.


Impact:

  • Prevents merge requests from being merged when CI pipeline checks fail.

  • Improves code quality and software reliability.

  • Identifies build, test, and integration issues before code is merged.

  • Supports secure software development and change management requirements.

  • May increase merge times while the CI pipeline checks are complete.


Default Value:

Disabled by default. Project administrators must explicitly configure merge request settings to require successful CI pipeline execution before merge.


Remediation

Test Plan

  1. Navigate to the target GitLab project.

  2. Create a merge request against a protected branch.

  3. Ensure the CI pipeline has not completed successfully or is in a failed state.

  4. Attempt to merge the merge request.

  5. Verify that the merge is blocked.

  6. Run the CI pipeline and ensure it completes successfully.

  7. Attempt to merge the merge request again.

  8. Verify that the CI pipeline requirement is configured and enforced before merge.

  9. If the CI pipeline requirement is not configured or enforced, follow the Implementation Steps to remediate the issue and repeat the test.


Implementation Steps:

  1. Sign in to GitLab with Maintainer or Owner access to the project.

  2. Navigate to the target project.

  3. Create or verify the existence of a CI/CD pipeline using a .gitlab-ci.yml configuration file.

  4. Execute the pipeline and verify that it runs successfully.

  5. Under Settings, click Merge requests.

  1. Under Merge checks, enable Pipelines must succeed.

  1. Save the configuration changes.


Backout Plan:

  1. Sign in to GitLab with Maintainer or Owner access to the project.

  2. Navigate to the target project.

  3. Select Settings → Merge requests.

  4. Disable Pipelines must succeed.

  5. Save the configuration changes.


References: