Vendor project templates as plain archives instead of as project exports

Problem to solve

Currently, vendored project templates are full blown project exports, and could in theory include various project metadata and git repository details. But when initialising a project from a vendored project template, I believe we only want two things:

  1. the boilerplate source code
  2. a single commit, ideally in the name of the person creating the project

In other words, I believe we do not want any of the other data usually associated with an exported project.

Presently, only (1) is fully served by the current solution, as the vendoring process causes the first commit to always be authored by GitLab <root@localhost>. And the vendoring process is quite involved, see e.g. https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/31592 and its linked issues.

I would like to address both (1) and (2), and simplify the vendoring process as a byproduct (full disclosure: Simplifying the vendoring process was my original motivation)

Implementing this would solve https://gitlab.com/gitlab-org/gitlab-ce/issues/36899 for vendored templates, and could be extended to instance-level templates.

Intended users

All users and maintainers of vendored project templates

Further details

Proposal

My proposal is to vendor projects as plain source code archives, such as the ones that can be downloaded via the Repositories: Get file archive endpoint.

Projects from these templates could then be initialised in two steps:

  1. Create an empty project
  2. Create a commit with all the files in the source template. This also opens up the possibility for the creator to customise the first commit message.

We could try using Repository#multi_action for the second step, and iterate if this turns out not to be efficient enough.

Note: The same approach could also be applied to instance wide project templates on import. But it is possible that users are currently relying on things like issues from the source template to get imported, so additional investigation is required (for vendored project templates, this should not be a problem).

Permissions and Security

Documentation

Testing

What does success look like, and how can we measure that?

Links / references