Skip to content
GitLab
Next
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • GitLab GitLab
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 44,761
    • Issues 44,761
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 1,329
    • Merge requests 1,329
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Container Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Metrics
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • GitLab.orgGitLab.org
  • GitLabGitLab
  • Issues
  • #335209
Closed
Open
Issue created Jul 05, 2021 by Vladimir Shushlin@vshushlin2️⃣Developer

Allow guests to see tag names associated with releases

Currently, we treat "tag names" associated with releases as source code and don't allow guests to see them.

But:

  1. we use the tag name as ID for releases, so without it, guests won't be able to see the release page.
  2. we use tag name as the default "name" for the release, so guest will see releases called "release-ID" (which is a strange user experience)
  3. we even consider removing some features for guest users to preserve this security feature
  4. all these workarounds require a lot of time of our development team to support

We can solve of this by relaxing security requirements a little and allowing users to see tag name for releases. (Note that all tag related information like commit SHA will still be unavailable)

The end result is

  1. Guests see proper names of releases (in case name is empty we show tag as name)
  2. Guests can visit the individual release page (tag is treated as ID, so previously we couldn't give users URL)
  3. We can remove all other workarounds we put in place to prevent a user from knowing the tag name. (Tracked in a separate issue #345568 (closed))
Edited Nov 12, 2021 by Bala Kumar
Assignee
Assign to
Time tracking