Skip to content

Pipeline Trigger API and UI with user permissions

We have Build Triggers API that hasn't been upgraded since: https://docs.gitlab.com/ee/user/project/new_ci_build_permissions_model.html.

FE: @kushalpandya

The new CI permission model allows us to fetch sources/images from all dependent projects. Build triggers, because they are user-less, use the old method of "permissions", which only allows fetching from the directly related project.

Idea

  1. Change Build Triggers to Pipeline Triggers,
  2. Add /pipelines/trigger endpoint to fulfill the 1.,
  3. Deprecate /builds/trigger,
  4. Extend Pipeline Triggers to store User ID of user that did create a trigger,
  5. Allow editing of user which permissions are used for running a pipeline,
  6. Allow editing of the description (we add description to make triggers named, and to know which trigger can be removed).

What is needed

  1. A new /pipelines/trigger endpoint (For 8.17),
  2. A new column for ci_triggers: user_id (For 8.17),
  3. A new column for ci_triggers: description (For 8.17),
  4. An ability to edit existing triggers (For 8.17),
  5. With 9.0 remove code that is responsible for supporting deprecated user-less method of CI authentication.

Edge cases

  1. If user will be removed we will nullify the ci_triggers.user_id making it to behave as previously or with 9.0 to generate a permission denied,
  2. If user will get blocked or removed from group it will automatically loose permissions to run CI pipelines with this trigger.

Implementation

Design

image

image

image

image

cc @markpundsack @dimitrieh @grzesiek