Authorizing

Authorizing a build means approving its review merge request in GitLab under your own account. Attest does this for you, using your own GitLab session. There is no service account involved and no way for anyone to approve on your behalf.

Two sign ins, and why

You sign in to the console with your organization's single sign on. That gives you your role and your queue, but it does not let the console do anything in GitLab.

Acting in GitLab as yourself needs your own GitLab identity. The first time you claim a container, accept or reject a finding, or authorize, the console offers Connect GitLab. You consent once, on GitLab's own screen, and Attest never sees your password. After that, everything you do in GitLab through the console runs on your own short lived token, and GitLab applies its own permissions regardless of what role you have in the console.

You can disconnect GitLab from the profile menu at any time. That only revokes this application's access to your GitLab account; your console session is unaffected.

When Authorize unlocks

The Authorize control is enabled only when all three of these are true.

1. No hard gate failed.
2. Every soft finding has a recorded decision.
3. None of those decisions is a rejection.

Until then the control is disabled and tells you what is still open.

The authorization bar. It stays visible as you scroll through the package and unlocks when every finding is decided.

What Authorize does

The console asks you to confirm that you want to authorize this container and version. On confirmation it approves the merge request in GitLab under your username and records the decision with your name, the time, the evidence hash, and the policy version. The console then reports that the merge request was approved as you.

Your approval is the authorization. Merging is a separate step that belongs to the engineering team, so the merge request stays open until they merge it. Merging promotes the scan record from the branch to main.

What Reject does

If a hard gate failed, the page says so and the only control offered is Reject submission. Your reason is posted to the merge request and it is closed under your account. Engineering resubmits on a new tag.

GitLab permissions you need

Developer access or above on the security repository for your security group. You do not need any access to the application repositories, because every review operation happens in the security repository. If a project uses an approval rule, the rule names the reviewers directly and Attest works within it.

What an administrator can and cannot do

An administrator can see every decision and can release a claim that is stuck because a reviewer walked away mid review. An administrator cannot approve for you. Authorization cannot be delegated, in the console or in GitLab.