Added settings override

rhodecode/apps/repository/views/repo_pull_requests.py

@@ -968,6 +968,9 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView):
         close_branch_before_merging_key = "rhodecode_%s_close_branch_before_merging" % source_repo.repo_type
         c.repo_close_branch_before_merging = self._get_repo_setting(source_repo, close_branch_before_merging_key)
 
+        # Get security scan setting for pre-checking the checkbox
+        c.pr_security_scan_enabled = self._get_repo_setting(source_repo, "rhodecode_pr_security_scan_enabled", False)
+
         return self._get_template_context(c)
 
     @LoginRequired()

rhodecode/model/forms.py

@@ -443,6 +443,7 @@ class _BaseVcsSettingsForm(formencode.Schema):
     rhodecode_pr_merge_enabled = v.StringBoolean(if_missing=False)
     rhodecode_auto_merge_enabled = v.StringBoolean(if_missing=False)
     rhodecode_use_outdated_comments = v.StringBoolean(if_missing=False)
+    rhodecode_pr_security_scan_enabled = v.StringBoolean(if_missing=False)
 
     # hg
     extensions_largefiles = v.StringBoolean(if_missing=False)

rhodecode/model/settings.py

@@ -456,6 +456,7 @@ class VcsSettingsModel:
         "use_outdated_comments",
         "pr_merge_enabled",
         "auto_merge_enabled",
+        "pr_security_scan_enabled",
         "hg_use_rebase_for_merging",
         "hg_close_branch_before_merging",
         "hg_merge_strategy_selector",

rhodecode/templates/base/vcs_settings.mako

@@ -261,6 +261,24 @@
                 <div class="label">
                     <span class="help-block">${_('When enabled, the target branch field will be automatically populated when creating pull requests. Disable this to prevent expensive diff calculations on repositories with many divergent branches.')}</span>
                 </div>
+
+                %if c.rhodecode_edition_id != 'EE':
+                    <div class="checkbox">
+                        <input type="checkbox" disabled>
+                        <label>${_('Enable security scan for pull requests')}</label>
+                    </div>
+                    <div class="label">
+                        <span class="help-block">${_('This feature is available in RhodeCode EE edition only. Contact {sales_email} to obtain a trial license.').format(sales_email='<a href="mailto:sales@rhodecode.com">sales@rhodecode.com</a>')|n}</span>
+                    </div>
+                %else:
+                    <div class="checkbox">
+                        ${h.checkbox('rhodecode_pr_security_scan_enabled' + suffix, 'True', **kwargs)}
+                        <label for="rhodecode_pr_security_scan_enabled${suffix}">${_('Enable security scan for pull requests')}</label>
+                    </div>
+                    <div class="label">
+                        <span class="help-block">${_('When enabled, the security scan checkbox will be pre-selected when creating pull requests. This scans the PR diff for exposed secrets and credentials.')}</span>
+                    </div>
+                %endif
             </div>
         </div>
     % endif

rhodecode/templates/pullrequests/pullrequest.mako

@@ -232,7 +232,7 @@
 
                             % if c.rhodecode_edition_id == 'EE':
                             <div class="pull-request-settings">
-                                ${h.checkbox('run_security_audit', checked=False, value=True)}
+                                ${h.checkbox('run_security_audit', checked=c.pr_security_scan_enabled, value=True)}
                                 <label for="run_security_audit">
                                     ${h.literal(_('Run security audit on PR diff'))}
                                     <span class="tooltip" title="${_('Scan only the changes in this pull request for exposed secrets and credentials. Results will appear in the PR sidebar.')}">[?]</span>