Abuse Reporting System Fails for Mirror Repos and Discussion-Free Repos
Forgive me if this is a duplicate. It's hard to search for "bug" + "report" without getting all "bug reports" instead of "bug with report system". :)
Summary
This is a simple issue/oversight. Gitlab offers few ways to report harrassment or abuse, and they seem to rely entirely on using a "report" button on comments or merge requests. This is.. a bit daft. There are many ways to harrass or harm or abuse people besides textual messages in forum-form, and it appears that there is currently no way to open a report unless there is a comment or merge request to 'pin' it to.
And, on to the "bug": if a user mirrors a Github repo, you cannot access a reporting button on any of the mirrored 'merges' or commits in the mirror. So even if a repo is importing abusive content into Gitlab there is no way to raise this with Gitlab support.
Steps to reproduce
On any mirrored repo, look for a reporting option on merges or commits. As far as I can see there will be no means to report abusive content in a mirrored repo.
Example Project
Let's just use one of my mirrored old projects from Github. Let's pretend that this readme actually contains abusive content:
What is the current bug behavior?
It is not possible to report projects, files, commits, etcetera, in mirrored repos.
In regular repos, it is also apparently not possible to report abusive files, only abusive messages in comment threads, issues, or merge requests. This is woefully inadequate.
What is the expected correct behavior?
That you can report abusive content of any kind.
Relevant logs and/or screenshots
N/A
Output of checks
N/A
Results of GitLab environment info
N/A
Results of GitLab application Check
N/A
Possible fixes
I imagine the workflow, being based on posts authored by single individuals, would need significant re-working to handle arbitrary files. But at the very least if the system could be extended to include commits (which maybe could fit the schema for a single-user-generated-thing, in this case a diff) then it could also be applied to mirrored content.. albeit by "blaming" the mirror bot!
Alternatively, just start monitoring your documented abuse email address? I tried reporting there and got an automated reply saying that it's unmonitored.