Skip to content

Improve error communication when enabling Secret Detection using an MR

When enabling Secret Detection from the repository security configuration page, if a repository has an existing .gitlab-ci.yml that contains anchors/aliases, the action will fail with an error. This is due to a YAML parsing issue (relevant discussion : #326532 (comment 1130382230)).

This error scenario needs to be communicated to users.

Might also be helpful to suggest a workaround (most likely asking them to manually add a snippet to their .gitlab-ci.yml)

Steps to reproduce

  1. Create a new repository and add some files to it.
  2. Within the repository create a .gitlab-ci.yml. Specifically, add at least one anchor/alias to it. Check below for an example.
  3. Go to "Security and Compliance" > "Configuration". Scroll down to "Secret Detection" and press "Configure with Merge Request".
  4. Doing so will lead to an error shown at the top of the page image
Example .gitlab-ci.yml with anchor and alias image

Steps to Implement

  1. Backend should return a specific error when this scenario happens
  2. Update Security Configuration documentation to reflect a workaround for this scenario.
  3. Add a "Troubleshooting" section in the Security Configuration documentation explaining why anchors and aliases cannot be parsed correctly. (Helpful discussion)
  4. Map the received error to show the copy on the front-end

Copy

Relevant discussion

Secret Detection cannot be enabled automatically using a merge request. The .gitlab-ci.yml file contains YAML anchors and aliases, and these cannot be processed correctly. Instead, you must manually include the template.

Edited by Arpit Gogia