External commit statuses are inaccessible when GitLab CI/CD is disabled
Summary
Some users are not authorized to view externally created commit statuses when GitLab CI/CD is disabled. If GitLab CI/CD is re-enabled on the project, these same users can now view the external statuses.
For example, with the Jenkins integration enabled and a merge request is created, it correctly shows a Jenkins build in the GitLab UI, but the link from the merge request to the Jenkins build is broken. Due to permission checks, the page shows a 404 instead of the details of the external commit status.
Steps to reproduce
- Create a GitLab project
- under Settings > Features, disable CI/CD
- enable Jenkins integration
- Create a Jenkins Multibranch Pipeline
- enable the GitLab plugin
- in the pipeline, add
options { gitLabConnection('…') }
- In the GitLab project, create a merge request
-
✅ GitLab launches a Jenkins build -
❌ the link from the merge request to the Jenkins build ("Pipeline #1563 passed for 230869bb on some-branch") is broken
-
Example Project
n/a
What is the current bug behavior?
Clicking the link shows "404 Page Not Found".
What is the expected correct behavior?
Clicking the link should take me to the build on the Jenkins instance
Clicking the link should take me to the view pipeline build page, as external pipelines should always be viewable
Relevant logs and/or screenshots
Merge request page with an arrow pointing to the broken link | After clicking on the "Pipeline #1563" link |
---|---|
Output of checks
Results of GitLab environment info
Expand for output related to GitLab environment info
System information System: Proxy: no Current User: git Using RVM: no Ruby Version: 3.0.6p216 Gem Version: 3.4.13 Bundler Version:2.4.14 Rake Version: 13.0.6 Redis Version: 6.2.13 Sidekiq Version:6.5.7 Go Version: unknown GitLab information Version: 16.1.3-ee Revision: 6bcf60f9a21 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 13.11 URL: https://….net HTTP Clone URL: https://….net/some-group/some-project.git SSH Clone URL: git@….net:some-group/some-project.git Elasticsearch: yes Geo: no Using LDAP: no Using Omniauth: yes Omniauth Providers: openid_connect GitLab Shell Version: 14.23.0 Repository storages: - default: unix:/var/opt/gitlab/gitaly/gitaly.socket GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell
Results of GitLab application Check
Expand for output related to the GitLab application check
Checking GitLab subtasks ... Checking GitLab Shell ... GitLab Shell: ... GitLab Shell version \>= 14.23.0 ? ... OK (14.23.0) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Internal API available: OK Redis available via internal API: OK gitlab-shell self-check successful Checking GitLab Shell ... Finished Checking Gitaly ... Gitaly: ... default ... OK Checking Gitaly ... Finished Checking Sidekiq ... Sidekiq: ... Running? ... yes Number of Sidekiq processes (cluster/worker) ... 1/1 Checking Sidekiq ... Finished Checking Incoming Email ... Incoming Email: ... Checking Reply by email ... IMAP server credentials are correct? ... Checking gitlabincoming yes Mailroom enabled? ... skipped MailRoom running? ... skipped Checking Reply by email ... Finished Checking Incoming Email ... Finished Checking LDAP ... LDAP: ... LDAP is disabled in config/gitlab.yml Checking LDAP ... Finished Checking GitLab App ... Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Cable config exists? ... yes Resque config exists? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Systemd unit files or init script exist? ... skipped (omnibus-gitlab has neither init script nor systemd units) Systemd unit files or init script up-to-date? ... skipped (omnibus-gitlab has neither init script nor systemd units) Projects have namespace: ... 62/538 ... yes … 62/1586 ... yes Redis version \>= 6.0.0? ... yes Ruby version \>= 2.7.2 ? ... yes (3.0.6) Git user has default SSH configuration? ... yes Active users: ... 8 Is authorized keys file accessible? ... skipped (authorized keys not enabled) GitLab configured to store new projects in hashed storage? ... yes All projects are in hashed storage? ... yes Elasticsearch version 7.x-8.x or OpenSearch version 1.x ... yes (elasticsearch 8.9.0) All migrations must be finished before doing a major upgrade ... yes Checking GitLab App ... Finished Checking GitLab subtasks ... Finished
Possible fixes
I noticed that if I click the green checkmark on the right side of the pipeline widget, then click the link inside that popup, it correctly takes me to the build on the Jenkins instance. The main "Pipeline #1563" link should go to the same place, rather than being a broken link.
This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.
This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.