Merge branch '207927-validate-actor-user-against-codeowners' into 'master'

Resolve "Validate actor/user against CODEOWNERS"

Closes #207927

See merge request gitlab-org/gitlab!26027

changelogs/unreleased/207927-validate-actor-user-against-codeowners.yml

+---
+title: Validate actor against CODEOWNERS entries
+merge_request:
+author:
+type: fixed

ee/lib/ee/gitlab/checks/diff_check.rb

@@ -23,7 +23,10 @@ module EE
           lambda do |paths|
             loader = ::Gitlab::CodeOwners::Loader.new(project, branch_name, paths)
 
-            assemble_error_msg_for_codeowner_matches(loader) if loader.entries.any?
+            return if loader.entries.blank?
+            return if loader.members.include?(change_access.user_access.user)
+
+            assemble_error_msg_for_codeowner_matches(loader)
           end
         end
 

ee/lib/gitlab/code_owners/users_loader.rb

@@ -8,8 +8,12 @@ module Gitlab
         @extractor = extractor
       end
 
+      # Generate a list of all project members who are mentioned in the
+      #   CODEOWNERS file, and load them to the matching entry.
+      #
       def load_to(entries)
         members = project.members_among(users)
+
         entries.each do |entry|
           entry.add_matching_users_from(members)
         end

ee/spec/lib/gitlab/checks/diff_check_spec.rb

@@ -36,21 +36,35 @@ describe Gitlab::Checks::DiffCheck do
       end
 
       before do
-        project.add_developer(code_owner)
         allow(project.repository).to receive(:code_owners_blob)
           .with(ref: codeowner_lookup_ref)
           .and_return(codeowner_blob)
       end
 
       context "the MR contains a matching file path" do
-        it "return an error message" do
-          expect(subject.send(:validate_code_owners)
-            .call(["docs/CODEOWNERS", "README"])).not_to be_nil
+        let(:validation_result) do
+          subject.send(:validate_code_owners).call(["docs/CODEOWNERS", "README"])
+        end
+
+        context "and the user is not listed as a code owner" do
+          it "returns an error message" do
+            expect(validation_result).to include("Pushes to protected branches")
+          end
+        end
+
+        context "and the user is listed as a code owner" do
+          # `user` is set as the owner of the incoming change by the shared
+          #   context found in 'push rules checks context'
+          let(:codeowner_content) { "* @#{user.username}" }
+
+          it "returns nil" do
+            expect(validation_result).to be_nil
+          end
         end
       end
 
       context "the MR doesn't contain a matching file path" do
-        it "doesn't raise an exception" do
+        it "returns nil" do
           expect(subject.send(:validate_code_owners)
             .call(["docs/SAFE_FILE_NAME", "README"])).to be_nil
         end