Add options to configure internal repo handling for GitLab #57858
Conversation
github-actions
bot
added
the
team/source
|
Codenotify: Notifying subscribers in CODENOTIFY files for diff 17e8f2d...114d762.
|
doc/admin/external_service/gitlab.md
Outdated
| } | ||
| ``` | ||
|
|
||
| If you would like internal repositories to remain private, but you're experiencing issues where user permission syncs aren't granting access to internal repositories, you can add the following field instead: |
There was a problem hiding this comment.
when would I experience these issues and how do I notice that I do?
| repoVisibility := []string{"private"} | ||
| if listInternalRepos { | ||
| repoVisibility = append(repoVisibility, "internal") | ||
| } | ||
|
|
||
| // This method is meant to return only private or internal projects | ||
| for _, visibility := range []string{"private", "internal"} { | ||
| for _, visibility := range repoVisibility { |
There was a problem hiding this comment.
This changes the default here, correct? Would this cause any trouble to existing instances?
There was a problem hiding this comment.
Yeah I'm still thinking about this a bit. I'm flip-flopping a bit between what would be the better option.
I don't mind changing the default behaviour too much, as long as we mention it in the changelog. And the behavioural change won't be particularly destructive.
I'd just like to settle on a default behaviour that would work for most cases. Which might be: private internal repos with syncing enabled 🤔 will let it stew a bit
There was a problem hiding this comment.
We could probably just condense the settings to the single markInternalReposAsPublic one? Since if they're public, you don't need permission syncs 🤔
internal/repos/gitlab.go
Outdated
| provider: provider, | ||
| client: client, | ||
| logger: logger, | ||
| markInternalReposAsPublic: (c.Authorization != nil) && c.Authorization.MarkInternalReposAsPublic, |
There was a problem hiding this comment.
hmm do we need that c.Authorization check here?
Is it to cover the case where someone sets it to false, but auth is off?
There was a problem hiding this comment.
Authorization can be nil here if it is completely unset, so accessing .MarkInternalReposAsPublic would throw a nil pointer exception
pjlast
force-pushed
the
pjlast/57804-default-permissions-gitlab-internal-repos
branch
from
4b0c373
to
66f946d
Compare
pjlast
deleted the
pjlast/57804-default-permissions-gitlab-internal-repos
branch
(cherry picked from commit 2ea61e5)
Closes #57804
This PR adds an option to GitLab code host connections called
markInternalReposAsPublic, which sets the visibility of all internal repos added by this code host connection totrue, and an option to the GitLab auth provider calledsyncInternalRepoPermissions.syncInternalRepoPermissionsare true by default, and can be set to false to optimise systems wheremarkInternalReposAsPublicis set to true.Test plan
Unit tests updated. Set up and tested locally as well.