Require the Socket check before merging

To block merges when a merge request introduces an alert set to Block, turn on merge checks. The app posts a Socket Security commit status on each merge request and turns on each project's Pipelines must succeed setting, so a failed status blocks the merge.

🚧

Use a release newer than 0.4.1

In version 0.4.1, editing a merge request or starting a CI pipeline on it can set the Socket status to canceled, which blocks merges that have no alerts. Leave merge checks off on 0.4.1.

Turn on merge checks

Before you start, give GITLAB_TOKEN the Maintainer role on each project. The app needs it to change the project's merge settings.

1. Add these two settings to socket-gitlab.env:

   Shell

   ENABLE_COMMIT_STATUS=true
   ENFORCE_MERGE_CHECKS=true

2. Recreate the container with docker rm -f socket-gitlab and the docker run command you used to start the app.

3. Check the startup log for one Enabled "pipelines must succeed" merge check line per project:

   Shell

   docker logs socket-gitlab 2>&1 | grep -i "merge check"

4. Open a merge request that changes a manifest file. The merge request shows a Socket Security status that passes when the change has no blocking alerts.

Choose what blocks a merge

Only alerts set to Block fail the status. To change which alerts block a merge, set their alert actions in your security policy. Alerts set to Warn, Monitor, or Ignore never fail the status. If a scan can't be created, the status is canceled, and the merge stays blocked until a rescan succeeds.

Pipelines must succeed applies to every pipeline in the project, including your CI. A merge request with no pipeline stays blocked. Tell your teams before you turn merge checks on.

Turn off merge checks

While ENFORCE_MERGE_CHECKS is true, the app turns Pipelines must succeed back on for every project each time it starts, and it never turns the setting off. To stop blocking merges:

1. Set ENFORCE_MERGE_CHECKS=false in socket-gitlab.env, and recreate the container.
2. Turn off Pipelines must succeed in each project's Settings > Merge requests.

To keep the commit status out of one project's merge requests, set gitlabApp.commitStatusEnabled: false in its socket.yml. While ENFORCE_MERGE_CHECKS is true, that project still requires a passing pipeline, so its merges stay blocked unless it has its own CI pipeline.

Report external status checks on GitLab Ultimate

On GitLab Ultimate, the app also reports its verdict as an external status check. Set ENABLE_EXTERNAL_STATUS_CHECKS=true, recreate the container, and turn on Status checks must succeed in each project's Settings > Merge requests.

Related topics

• How merge request scanning works
• Socket for GitLab permissions