Skip to content

Backend: Compliance framework pipelines can not include project prefill variables

Summary

According to the documentation, when you add

include:  # Execute individual project's configuration (if project contains .gitlab-ci.yml)
  project: '$CI_PROJECT_PATH'
  file: '$CI_CONFIG_PATH'
  ref: '$CI_COMMIT_REF_NAME' # Must be defined or MR pipelines always use the use default branch

into the compliance framework pipeline, you include the project configuration.

However, it does not work with the prefill-variables feature.

Steps to reproduce

  1. Create a group with the "premium" feature (my-group).
  2. Create my-group/project-1.
  3. Create my-group/project-2.
  4. In my-group/project-1, add this example .gitlab-ci.yml;
include:
  project: '$CI_PROJECT_PATH'
  file: '$CI_CONFIG_PATH'
  ref: '$CI_COMMIT_REF_NAME'

test1:
  script: exit 0
  1. In my-group/project-2, add this example .gitlab-ci.yml;
variables:
  VARY:
    description: this is var Y

test2:
  script: exit 0

  1. In my-group, add a new compliance framework with the my-group/project-1 config; Screenshot_2022-11-01_at_11.23.23

  2. In my-group/project-2, use this new compliance framework; Screenshot_2022-11-01_at_11.24.40

  3. Go to the "Run pipeline" on my-group/project-2;

  4. Result

Screenshot_2022-11-01_at_11.36.41

What is the current bug behavior?

Prefill variables are not visible on the "Run pipeline" on my-group/project-2.

What is the expected correct behavior?

Prefill variables should be visible on the "Run pipeline" on my-group/project-2.

Technical explanation

The problem here is the CI_COMMIT_REF_NAME variable. We do not define this variable when fetching prefill variables.

Possible fixes

We can persist the CI_COMMIT_REF_NAME variable when fetching prefill variables.

Workaround

Instead of using CI_COMMIT_REF_NAME, we can use CI_COMMIT_SHA to solve the problem. Besides, we need to add an if condition to the include:

include:
  - project: '$CI_PROJECT_PATH'
    file: '$CI_CONFIG_PATH'
    ref: '$CI_COMMIT_SHA'
    rules:
      - if: $CI_PROJECT_PATH != "my-group/project-1" # this is the project that hosts the configuration to avoid circular includes
Edited by Furkan Ayhan