Make it possible to disable "Download Artifacts" in GL GUI
Problem to solve
This solves the problem that sensitive data in GL artifacts should not be downloadable for developers through the Gitlab UI.
Intended users
Developers & DevOps Engineers, but especially happy Security Teams :)
Further details
We would love to have this feature for the following: One of our pipelines currently only renders and validates kubernetes yaml files and afterwards applies them. To share the outcome of each stage with the previous one it uses GL artifacts to pass the yaml files between the stages. Since some of the yaml files only contain sensitive information it is problematic that every developer can download them via the GUI.
Of course this is a rather specific case, but having this feature would help out with any pipeline that wants to share sensitive information via artifacts across multiple stages.
Proposal
Note: "Download Artifacts via GUI" refers to the complete pallet of options shown in the picture below
There are several options that would be feasible from our point of view
- Allow to completely disable "Download Artifacts via GUI" somewhere in the GL settings for the whole instance/group/project/...
- Allow to set in the .gitlab-ci to disable "Download Artifacts via GUI"
- Disallow on protected branches/protected environments to "Download Artifacts via GUI" at all
In our opinion option 3) would be the best option, as it would enable devs to download/browse artifacts for unprotected envs (e.g. development) but would not allow it for protected ones (e.g. production).
Permissions and Security
Permission structure in case of 3) could be the same as it already is, except that maintainers who can unprotect branches/envrionments should also be able to see the artifacts I'd guess.