Skip to content

WIP: Fork the target project if user has read-only access to it

What does this MR do?

On a POST to api/:id/repository/commits, if the current_user doesn't have push access to the target branch, find or create a fork of the target project and create a new branch for the commit(s).

https://gitlab.com/gitlab-org/gitlab-ce/issues/50850

This is a bit of a WIP, in that it "works" - existing and new tests are green locally, but I think there's definitely room for improvement. I'll in-line some commentary.

Does this MR meet the acceptance criteria?

Conformity

Performance and testing

I've added a pair of Happy Path tests, and would like to expand on them.

I would very much appreciate feedback on known issues with forking and branch creation.

Test performance is 🐌 here, which I'm, not thrilled about; any advice, techniques, or examples for better ways to structure this? I'm assuming that forking of project and repository is an expensive action.

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Merge request reports