Merge request approvals

DETAILS: Tier: Free, Premium, Ultimate Offering: GitLab.com, Self-managed, GitLab Dedicated

You can configure your merge requests to allow (or require) approval before they merge. While GitLab Free allows all users with Developer or greater permissions to approve merge requests, these approvals are optional. GitLab Premium and GitLab Ultimate give you more flexibility:

Create required rules about the number and type of approvers before work can merge.
Build a list of users who act as code owners for specific files, and require their approval before work can merge.
For GitLab Premium and GitLab Ultimate, configure approvals for the entire instance.

You can configure merge request approvals on a per-project basis, and configure some approvals at the group level. Support for group-level settings for merge request approval rules is tracked in epic 4367.

View approval status

The list of merge requests for your project shows the approval status for each merge request:

Example	Description
	Required approvals are missing. ({approval})
	Approvals are satisfied. ({check})
	Approvals are satisfied, and you are one of the approvers. ({approval-solid})

When an eligible approver visits an open merge request, GitLab shows one of these statuses after the body of the merge request:

Approve: The merge request doesn't yet have the required number of approvals.
Approve additionally: The merge request has the required number of approvals.
Revoke approval: The user viewing the merge request has already approved the merge request.

Configuration options for approvals

Use merge request approval rules to set the minimum number of required approvals before work can merge into your project. You can also extend these rules to define what types of users can approve work. Some examples of rules you can create include:

Users with specific permissions can always approve work.
Code owners can approve work for files they own.
Users with specific permissions can approve work, even if they don't have merge rights to the repository.
Users with specific permissions can be allowed or denied the ability to override approval rules on a specific merge request.

You can also configure:

Additional settings for merge request approvals for more control of the level of oversight and security your project needs.
Merge request approval rules and settings through the GitLab UI or with the Merge request approvals API.

You can't change the approvals on a merge request after it merges.

Optional approvals

GitLab allows all users with Developer or greater permissions to approve merge requests. Approvals in GitLab Free are optional, and don't prevent a merge request from merging without approval.

Required approvals

DETAILS: Tier: Premium, Ultimate Offering: GitLab.com, Self-managed, GitLab Dedicated

Moved to GitLab Premium in 13.9.

Required approvals enforce code reviews by the number and type of users you specify. Without the approvals, the work cannot merge. Required approvals enable multiple use cases:

Enforce review of all code that gets merged into a repository.
Specify reviewers for a given proposed code change, and a minimum number of reviewers, through Approval rules.
Specify categories of reviewers, such as backend, frontend, quality assurance, or database, for all proposed code changes.
Use the code owners of changed files, to determine who should review the work.
Require an approval before merging code that causes test coverage to decline.
Users on GitLab Ultimate can also require approval from a security team before merging code that could introduce a vulnerability.

Approve a merge request

Eligible approvers can also use the /approve quick action when adding a comment to a merge request. Users in the reviewer list who have approved a merge request display a green check mark ({check-circle-filled}) next to their name.

After a merge request receives the number and type of approvals you configure, it can merge unless it's blocked for another reason. Merge requests can be blocked by other problems, such as merge conflicts, unresolved threads, or a failed CI/CD pipeline.

To prevent merge request authors from approving their own merge requests, enable Prevent author approval in your project's settings.

If you enable approval rule overrides, merge requests created before a change to default approval rules are not affected. The only exceptions are changes to the target branch of the rule.

Invalid rules

Introduced in GitLab 15.1.

Changed in GitLab 15.11 with a flag named invalid_scan_result_policy_prevents_merge. Disabled by default.

Generally available in GitLab 16.2. Feature flag invalid_scan_result_policy_prevents_merge removed.

When an approval rule is impossible to satisfy, GitLab shows the rule as Auto approved. This happens when:

The only eligible approver is also the merge request author.
No eligible approvers (either groups or users) are assigned to the approval rule.
The number of required approvals is greater than the number of eligible approvers.

These rules are automatically approved to unblock their respective merge requests, unless you created them through a merge request approval policy. Invalid approval rules created through a merge request approval policy are:

Shown with Action required.
Not automatically approved.
Blockers for merge requests they affect.