Skip to content

Allow pipeline status to be queried via job token authentication

What does this MR do?

Currently job tokens can be used to trigger pipelines but cannot be used to check the status of the pipelines result. This significantly complicates the rather common use-case of triggering a pipeline and failing if the triggered pipeline fails (see gitlab-ee#5096).

This limitation seems especially silly given that job tokens can be used to download artifacts, which poses a significantly greater threat of information leakage than a simple pipeline status query.

Here we treat single pipeline queries similarly to how artifact GET requests are handled, admitting authentication via job token.

What are the relevant issue numbers?

Closes gitlab-ee#5096

Does this MR meet the acceptance criteria?

Edited by Toon Claes

Merge request reports