Explicitly mark force-pushes as such in MR activity / notes
Problem to solve
As discussed in #212763 (comment 386072775), the current activity / notes section in an MR doesn't make it clear when commits are removed or changed due to force-pushes.
Intended users
MR reviewers who want to be informed if commit IDs are changed or commits are removed (esp. in regulated environments).
- Cameron (Compliance Manager)
- Sasha (Software Developer)
- Devon (DevOps Engineer)
- Sam (Security Analyst)
- Simone (Software Engineer in Test)
User experience goal
As an alternative to preventing force-pushing generally, the milder option of being explicitly informed of/about such events is proposed here. Currently, it's possible to determine whether a force-push occurred, but it's not obvious (only by comparing hashes and commit messages, see red boxes; example from https://gitlab.com/gitlab-org/gitlab/-/merge_requests/36282):
Esp. the case of "removal of top commits" is not reflected clearly, only discernible by circumstantial evidence like entries in the Pipelines tab that don't seem to correspond to any entry in the Commits tab, or in the Changes > Versions selector.
Proposal
Instead of showing only
…User name @username… added … commits …
sha12345...ash67890 - … commits from branch …
sha98765 - …message…in the activity / notes section of the MR: detect the fact that push --force was used and show
…User name @username… force-pushed … commits …
sha12345...ash67890 - … commits from branch …
sha09876 - …same message…
and removed commits
sha98765 - …same message…Further details
@rvzon & me briefly discussed whether this might be possible via a pre-receive hooks.
This FR seems to be slightly opposing to issues that see too much visibility of old information that's attached to commits which have been changed/removed by force-pushes as a problem:
Maybe an instance-, group- or project-level setting is needed to satisfy both camps?