• 
      

    Disallow users from saying "Ship It!" to their own review requests.

    Review Request #14198 — Created Oct. 11, 2024 and submitted — Latest diff uploaded

    Information

    Review Board
    release-7.1.x

    Reviewers

    We've always taken a pretty hands-off approach, preferring to encourage
    conversation over policy. That said, one of the most requested bits of
    policy is to make it so users can't mark their own review requests as
    "Ship It". This is not only a reasonable policy ask (especially if
    people are using approval workflows that can block pushes), but should
    probably be the default.

    This change implements that. The visibility of the "Ship It" action and
    checkbox in the review dialog are now conditional on this flag, and
    reviews will refuse to publish (either via the UI or API).

    Because a big change like this may be controversial, I've added a toggle
    for it in the admin settings, under a new page titled "Review Workflow".

    While adding tests for the action, I discovered that several of our
    existing action tests were accidentally still testing the legacy
    versions of the actions (imported via the old
    reviewboard.reviews.default_actions module). I've fixed it up so we
    have separate tests for the legacy and modern versions of actions that
    exist in the unified banner.

    • Viewed a review request as both the owner and another user, and saw
      that the visibility of the action and review dialog checkbox was
      correct.
    • Toggled the setting in the admin and checked again, seeing that I
      could restore previous behavior.
    • Ran unit tests.

    Commits

    Files