File-based group export sub-group always imports as private
Overview
When using the file based export-import to migrate groups they make contain sub-groups.
These groups, by design, import with the following visibility
Imported groups are given a private visibility level, unless imported into a parent group. If imported into a parent group, a subgroup inherits the same level of visibility unless otherwise restricted.
whether this logic is expected is a different topic and probably deserves a separate issue if incorrect. E.g. because the visibility should, if possible, remain the same or stricter between source and destination GitLab instance.
However, sub-group(s), which are part of an exported parent group, always import as private
, regardless of the source visibility, destination parent group and instance level visibility restrictions. This behavior is neither expected nor documented.
If imported into a parent group, a subgroup inherits the same level of visibility unless otherwise restricted.
Note: Quotes come from doc/user/group/import/index.md
, that should be adjusted with changes done for this issue.
Behavior - current
When a top-level private
group is exported and imported to an internal
parent group the imported group becomes internal
while the sub-group remains private
.
Changing the default group and project visibility to internal
and testing again:
- Group import - same behavior
- Project import - same behavior
Setting private
as restricted visibility level for groups and projects and testing again:
- Group import - same behavior
- Project import - same behavior
NOTE:
Selected levels cannot be used by non-admin users for groups, projects or snippets. If the public level is restricted, user profiles are only visible to logged in users.
Conclusions
- Exported
private
top-level groups will becomeinternal
on import to aninternal
parent group.- Their
private
sub-groups will remainprivate
.
- Their
-
internal
sub-groups, exported as part ofinternal
parent groups, will import asprivate
, even though their parents imported asinternal
(because of theinternal
parent group they imported to).
Behavior - expected
The sub-group imports with the same visibility as on source or stricter (e.g. if the parent group imported as private
).