How to easily employ an external RPM package build system as CI/CD
Hi, I'm one of the Fedora Copr maintainers (an RPM build system).
I've spent some time on reading gitlab docs to find a secure way to allow gitlab.com users to do CI/CD through our build system (on foss projects).
We could use the Turing complete power of Runners, but build of an RPM package can take some time (hours) and I suppose we'll be facing timeout issues.
I have found that we can easily start builds with webhooks, but every user would have to configure some webhook(s) (step 1), this is secure part. But not entirely convenient.
Then we need to allow the build system to somehow update the commit statuses, perhaps using some credentials -- and I only found that personal access tokens would be useable (step 2). The current problem seems to be that that to make this working, the access token needs to have the full API permissions. That doesn't seem to be secure (at our build system level, we don't want to be given to manipulate the repositories, we only want to create and modify commit statuses).
What to do?
Is there some common pattern to implement some CI/CD hook like that? Or
could we create -- along the
read_api, etc. token permissions
another permission level like
Or should we rather think about
Settings => Integrations category?