Description:

This check verifies that GitLab merge requests cannot be merged until the required review approvals have been obtained. Approval requirements ensure that code changes are reviewed and approved by authorized reviewers before being merged into protected branches.


Rationale:

Review approvals provide an additional layer of oversight by ensuring that code changes are evaluated for quality, security, and compliance before integration. Requiring approvals helps enforce segregation of duties, improve code quality, and reduce the risk of introducing unauthorized or unreviewed changes.


Impact:

Enforcing merge request approval requirements may:

  • Increase the time required to merge code changes.

  • Require collaboration between developers and reviewers.

  • Improve code quality and security.

  • Reduce the likelihood of defects and vulnerabilities reaching production.


Default Value:

Disabled

By default, GitLab does not require merge request approvals.

Default configuration:

  • Required Approvals: 0

  • Merge requests can be merged without reviewer approval.


Remediation:

Test Plan:

  1. Log in to GitLab with access to the project.

  2. Navigate to the target project.

  3. Navigate to Settings → Merge requests.

  4. Locate the Merge Request Approvals or Approval Rules section.

  5. Review the configured approval requirements.

  6. Verify that Approvals Required is set to 1 or greater.


Implementation:

  1. Log in to GitLab with Maintainer or Owner privileges.

  2. Navigate to the target project.

  3. Select Settings → Merge requests.

  1. Locate Merge Request Approvals or Approval Rules.

  2. Edit Merge Request Approvals or create new Merge Request Approvals.

  1. Enter a meaningful ruleset name and select the target branch(All Branches). Set the required number of approvals to 1. Add one or more eligible reviewers or groups.

  1. Save the configuration.


Backout Plan:

  1. Log in to GitLab with Maintainer or Owner privileges.

  2. Navigate to Settings → Merge requests.

  3. Locate Merge Request Approvals or Approval Rules.

  4. Change Approvals Required from 1 to 0 (or restore the previous value). Or delete the particular rule.

  1. Save the changes.

  2. Confirm that project operations are normal after the rollback.


References: