Breaking change: Leaked CI_JOB_TOKEN can be used for triggering pipelines in public projects despite scoping
For guidance on the overall deprecations, removals and breaking changes workflow, please visit Breaking changes, deprecations, and removing features
Setting this to Confidential for now as this is a security issue.
Deprecation Summary
Projects that are public or internal with project visibility levels set to "Team Members" will no longer authorize CI_JOB_TOKEN requests from projects not on the inbound allowlist when Restrict inbound access for CI_JOB_TOKEN is enabled.
Specific actions will depend on the specific project visibility setting:
- E.g. Container Registry Setting will affect CI_JOB_TOKEN ability to pull from containers images.
- Builds Setting will affect CI_JOB_TOKEN ability to read and download artifacts.
- Details for each setting is described here
Breaking Change
Affected Topology
Affected Tier
All tiers.
Checklists
Labels
-
This issue is labeled deprecation, and with the relevant ~devops::
,~group::
, and~Category:
labels. -
This issue is labeled breaking change if the removal of the deprecated item will be a breaking change.
Timeline
Please add links to the relevant merge requests.
- As soon as possible, but no later than the third milestone preceding the major release (for example, given the following release schedule:
14.8, 14.9, 14.10, 15.0
–14.8
is the third milestone preceding the major release):-
A deprecation announcement entry has been created so the deprecation will appear in release posts and on the general deprecation page. -
Documentation has been updated to mark the feature as deprecated.
-
-
On or before the major milestone: A removal entry has been created so the removal will appear on the removals by milestones page and be announced in the release post. - On the major milestone:
-
The deprecated item has been removed. -
If the removal of the deprecated item is a breaking change, the merge request is labeled breaking change.
-
Mentions
-
Your stage's stable counterparts have been @mentioned
on this issue. For example, Customer Support, Customer Success (Technical Account Manager), Product Marketing Manager.- To see who the stable counterparts are for a product team visit product categories
- If there is no stable counterpart listed for Sales/CS please mention
@timtams
- If there is no stable counterpart listed for Support please mention
@gitlab-com/support/managers
- If there is no stable counterpart listed for Marketing please mention
@cfoster3
- If there is no stable counterpart listed for Sales/CS please mention
- To see who the stable counterparts are for a product team visit product categories
-
Your GPM has been @mentioned
so that they are aware of planned deprecations. The goal is to have reviews happen at least two releases before the final removal of the feature or introduction of a breaking change.
Deprecation Milestone
Planned Removal Milestone
Links
Edited by Jocelyn Eillis