Ignore invalid project CI with pipeline execution policy using the `override_project_ci` strategy
Summary
With a pipeline execution policy using the override_project_ci
strategy, the project CI should be ignored. However if the project has an invalid CI/CD configuration, it is not possible to start a pipeline.
Steps to reproduce
- Create a group
- Create a project in the group
- Add a simple CI file to the project.
# polici-ci.yml build1: stage: .pipeline-policy-pre script: - echo "Do your build here"
- Go back to the group.
- On the projects left sidebar, select Security & Compliance and Policies.
- Select New Policy
- Select Pipeline execution policy
- Choose a name for the policy
- In the Actions section choose
Override
and select the project andpolici-ci.yml
file you created in step 2. and 3. - Select Update via Merge Request.
- Merge the MR.
- Go back to the group.
- Create a new project
- Add an invalid
.gitlab-ci.yml
file to the project. For example:test1: stage: non-existing-stage script: - echo "Do a test here"
- Go to Build and Pipelines.
- There should be a failed pipeline with the yaml invalid label
Implementation plan
This implementation plan is based on !159124 (merged).
We can pass a flag to sources that indicates if there are any overriding pipeline execution policies. If this is the case, we can ignore project CI/CD configs.
diff --git a/lib/gitlab/ci/pipeline/chain/config/content.rb b/lib/gitlab/ci/pipeline/chain/config/content.rb
index 0f5f72e449ba..ec0fdca00c74 100644
--- a/lib/gitlab/ci/pipeline/chain/config/content.rb
+++ b/lib/gitlab/ci/pipeline/chain/config/content.rb
@@ -34,10 +34,17 @@ def pipeline_config
pipeline_source: @command.source, pipeline_source_bridge: @command.bridge,
triggered_for_branch: @pipeline.branch?,
ref: @pipeline.ref,
- has_pipeline_execution_policies: @command.pipeline_execution_policies.present?
+ has_pipeline_execution_policies: @command.pipeline_execution_policies.present?,
+ has_overriding_pep: has_overriding_pep?
)
end
end
+
+ def has_overriding_pep?
+ return unless @command.pipeline_execution_policies.present?
+
+ !!@command.pipeline_execution_policies.any?(&:strategy_override_project_ci?)
+ end
end
end
end
diff --git a/lib/gitlab/ci/project_config.rb b/lib/gitlab/ci/project_config.rb
index dd00c2b25424..ac03bb969a05 100644
--- a/lib/gitlab/ci/project_config.rb
+++ b/lib/gitlab/ci/project_config.rb
@@ -29,7 +29,7 @@ class ProjectConfig
def initialize(
project:, sha:, custom_content: nil, pipeline_source: nil, pipeline_source_bridge: nil,
- triggered_for_branch: nil, ref: nil, has_pipeline_execution_policies: nil)
+ triggered_for_branch: nil, ref: nil, has_pipeline_execution_policies: nil, has_overriding_pep: nil)
@config = nil
sources.each do |source|
@@ -40,7 +40,9 @@ def initialize(
pipeline_source_bridge: pipeline_source_bridge,
triggered_for_branch: triggered_for_branch,
ref: ref,
- has_pipeline_execution_policies: has_pipeline_execution_policies)
+ has_pipeline_execution_policies: has_pipeline_execution_policies,
+ has_overriding_pep: has_overriding_pep
+ )
if source_config.exists?
@config = source_config
diff --git a/lib/gitlab/ci/project_config/repository.rb b/lib/gitlab/ci/project_config/repository.rb
index 0b250abb9e03..c83288d9954c 100644
--- a/lib/gitlab/ci/project_config/repository.rb
+++ b/lib/gitlab/ci/project_config/repository.rb
@@ -7,6 +7,8 @@ class Repository < Source
extend ::Gitlab::Utils::Override
def content
+ return if @has_overriding_pep
+
strong_memoize(:content) do
next unless file_in_repository?
diff --git a/lib/gitlab/ci/project_config/source.rb b/lib/gitlab/ci/project_config/source.rb
index 1b3c565d47f4..f12e2872ffbc 100644
--- a/lib/gitlab/ci/project_config/source.rb
+++ b/lib/gitlab/ci/project_config/source.rb
@@ -8,7 +8,7 @@ class Source
def initialize(
project:, sha:, custom_content: nil, pipeline_source: nil, pipeline_source_bridge: nil,
- triggered_for_branch: false, ref: nil, has_pipeline_execution_policies: nil)
+ triggered_for_branch: false, ref: nil, has_pipeline_execution_policies: nil, has_overriding_pep: nil)
@project = project
@sha = sha
@custom_content = custom_content
@@ -17,6 +17,7 @@ def initialize(
@triggered_for_branch = triggered_for_branch
@ref = ref
@has_pipeline_execution_policies = has_pipeline_execution_policies
+ @has_overriding_pep = has_overriding_pep
end
def exists?
Edited by Andy Schoenen