Show confirmation box when making merge request to a more visible project
Problem to solve
As part of re-enabling the ability to create merge requests from confidential issues, there are currently users (as Stan notes here), that can still make a merge request for a confidential issue. It is dependent on when you forked, and changed the visibility. We need to let the user know that they are potentially exposing the code if the project is more visible than the fork.
Proposal
When making a merge request and the parent project (target) is more visible than the child (source), we should an alert at the top of the Create MR form, below the branch selections (where it's most timely):
Perhaps a warning alert like this:
Reading:
This merge request will target a project that is more visible than the current one. Review the target project before submitting to avoid exposing private changes.
- OR, if we're able to indicate the project's visibility the text could adapt to:
This merge request is from a private project to a public project. Review the target project before submitting to avoid exposing private changes.
Further info
More context in epic: &4405 (closed)
Edited by Pedro Moreira da Silva