Improve documentation for `spp_repository_pipeline_access` project setting
The following discussions from !165626 (merged) should be addressed:
-
@rdickenson started a discussion: Use the `content` type in a policy to reference CI/CD configuration stored in a security policy project. This allows you to use the same CI/CD configuration among multiple policies, reducing the overhead of maintaining these configurations. For example, if you have a custom secret detection CI/CD configuration you want to enforce in policy A and policy B, you can reference the same configuration in both policies but it's stored as a single YAML file. Prerequisites: - Users triggering pipelines run in those projects on which a policy containing the `content` type is enforced must have at minimum read-only access to the project containing the CI/CD configuration. In GitLab 17.4 and later, you can grant the required read-only access by enabling the project setting **Scan execution policies**. Enabling this option allows the user who triggered the pipeline access to **only** the read the CI/CD configuration enforced by the scan execution policy.
@mcavoj This suggestion does not comply with the docs standards, but I think it helps explain the feature and the required permissions a little more. As I'm now on PTO please ask Ryan Lehmann for assistance from here.
@rlehmann1 By our docs standards, this would be written as two topics - concept and task. Here we've combined them into one. It's not ideal but we can polish this in a follow-up MR.
-
@rdickenson started a discussion: sppRepositoryPipelineAccessLabel: s__( 'ProjectSettings|Grant access to the CI/CD files named in security policies.', ), sppRepositoryPipelineAccessHelpText: s__( 'ProjectSettings|Allow users and tokens read-only access to fetch security policy configurations in this project to enforce policies. %{linkStart}Learn more%{linkEnd}.',
suggestion: @mcavoj Like my docs suggestion, please consider this a draft.
@rlehmann1 You may prefer to leave this just as it is, with is OK with me.
👍