diff --git a/doc/administration/audit_event_types.md b/doc/administration/audit_event_types.md index e779518eb06268508c96e0624d856217ba91469f..ca7d1e1643fadb124e050ad42e49430cf63fa764 100644 --- a/doc/administration/audit_event_types.md +++ b/doc/administration/audit_event_types.md @@ -189,6 +189,8 @@ Audit event types belong to the following product categories. | [`deploy_token_creation_failed`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/89391) | Audit event triggered when deploy token fails to create| **{check-circle}** Yes | **{check-circle}** Yes | GitLab [15.1](https://gitlab.com/gitlab-org/gitlab/-/issues/363087) | Project | | [`deploy_token_destroyed`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/89391) | Audit event triggered when deploy token is destroyed| **{check-circle}** Yes | **{check-circle}** Yes | GitLab [15.1](https://gitlab.com/gitlab-org/gitlab/-/issues/363087) | Project | | [`deploy_token_revoked`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/89391) | Triggered when project deploy token is revoked| **{check-circle}** Yes | **{check-circle}** Yes | GitLab [15.1](https://gitlab.com/gitlab-org/gitlab/-/issues/363087) | Project | +| [`deployment_approved`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/153375) | Triggered when a deployment is approved| **{check-circle}** Yes | **{check-circle}** Yes | GitLab [17.1](https://gitlab.com/gitlab-org/gitlab/-/issues/456685) | Project | +| [`deployment_rejected`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/153375) | Triggered when a deployment is rejected| **{check-circle}** Yes | **{check-circle}** Yes | GitLab [17.1](https://gitlab.com/gitlab-org/gitlab/-/issues/456685) | Project | | [`group_deploy_token_created`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/93091) | Audit event triggered when a groups deploy token is created| **{check-circle}** Yes | **{check-circle}** Yes | GitLab [15.3](https://gitlab.com/gitlab-org/gitlab/-/issues/363087) | Group | | [`group_deploy_token_creation_failed`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/93091) | Audit event triggered when a groups deploy token fails to create| **{check-circle}** Yes | **{check-circle}** Yes | GitLab [15.3](https://gitlab.com/gitlab-org/gitlab/-/issues/363087) | Group | | [`group_deploy_token_destroyed`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/93091) | Audit event triggered when group deploy token is destroyed| **{check-circle}** Yes | **{check-circle}** Yes | GitLab [15.3](https://gitlab.com/gitlab-org/gitlab/-/issues/363087) | Group | diff --git a/ee/app/services/deployments/approval_service.rb b/ee/app/services/deployments/approval_service.rb index 2c23832a856fb7e563221a4c69cd50e31d5f5b66..069a7061332b1f7bd23b4f9feeaa46e0c6e64e92 100644 --- a/ee/app/services/deployments/approval_service.rb +++ b/ee/app/services/deployments/approval_service.rb @@ -17,6 +17,8 @@ def execute(deployment, status) approval = upsert_approval(deployment, status, params[:comment]) return error(approval.errors.full_messages) if approval.errors.any? + create_audit_event(deployment, approval) + process_build!(deployment, approval) deployment.invalidate_cache @@ -41,6 +43,21 @@ def upsert_approval(deployment, status, comment) end end + def create_audit_event(deployment, approval) + audit_context = { + name: "deployment_#{approval.status}", + author: current_user, + scope: deployment.project, + target: deployment.environment, + message: "#{approval.status.capitalize} deployment with IID: #{deployment.iid} and ID: #{deployment.id}", + additional_details: { + comment: approval.comment + } + } + + ::Gitlab::Audit::Auditor.audit(audit_context) + end + def process_build!(deployment, approval) return unless deployment.deployable diff --git a/ee/config/audit_events/types/deployment_approved.yml b/ee/config/audit_events/types/deployment_approved.yml new file mode 100644 index 0000000000000000000000000000000000000000..6372ec35e3f35e8280ff9a1be23e74254dc0b04e --- /dev/null +++ b/ee/config/audit_events/types/deployment_approved.yml @@ -0,0 +1,10 @@ +--- +name: deployment_approved +description: Triggered when a deployment is approved +introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/456685 +introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/153375 +feature_category: continuous_delivery +milestone: '17.1' +saved_to_database: true +streamed: true +scope: [Project] diff --git a/ee/config/audit_events/types/deployment_rejected.yml b/ee/config/audit_events/types/deployment_rejected.yml new file mode 100644 index 0000000000000000000000000000000000000000..c8d1f7a3421178e1f13047b345040a9d9f937e6d --- /dev/null +++ b/ee/config/audit_events/types/deployment_rejected.yml @@ -0,0 +1,10 @@ +--- +name: deployment_rejected +description: Triggered when a deployment is rejected +introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/456685 +introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/153375 +feature_category: continuous_delivery +milestone: '17.1' +saved_to_database: true +streamed: true +scope: [Project] diff --git a/ee/spec/services/deployments/approval_service_spec.rb b/ee/spec/services/deployments/approval_service_spec.rb index a784ab6c03154fd678148627bf76ccbf7dd97f4c..eeff7a7d4b5a6c4925cc0b2544358849299f159f 100644 --- a/ee/spec/services/deployments/approval_service_spec.rb +++ b/ee/spec/services/deployments/approval_service_spec.rb @@ -106,6 +106,25 @@ end end + shared_examples_for 'audit event' do + let(:comment) { 'LGTM!' } + + it 'creates an audit event' do + expect(Gitlab::Audit::Auditor).to receive(:audit).with({ + name: "deployment_#{status}", + author: user, + scope: project, + target: environment, + message: "#{status.capitalize} deployment with IID: #{deployment.iid} and ID: #{deployment.id}", + additional_details: { + comment: comment + } + }) + + subject + end + end + describe '#execute' do subject { service.execute(deployment, status) } @@ -113,6 +132,7 @@ include_examples 'approve' include_examples 'comment' include_examples 'set approval rule' + include_examples 'audit event' end context 'when status is rejected' do @@ -121,6 +141,7 @@ include_examples 'reject' include_examples 'comment' include_examples 'set approval rule' + include_examples 'audit event' end context 'when user approves for different groups' do