Project setting for "CI job token access" should be accessible even when project feature `CI/CD` is disabled
Release notes
The project setting Allow CI job tokens from the following projects to access this project
(in the project setting CI/CD > Token Access
) should be accessible even when the project feature CI/CD
is disabled.
Problem to solve
When the project feature CI/CD
is disabled then project maintainers cannot define which CI job tokens from the other projects are allowed to access this project. This is a problem because it is possible that a project without the project feature CI/CD
will be accessed by another projects ci pipeline, e.g. a public project might not have the project feature CI/CD enabled, but the files of this public project need to be accessed by another project's ci pipeline.
Steps to reproduce:
- I create a new project
public-project-without-ci-cd
in GitLab - Disable the project feature
CI/CD
in the general project setting area; do not forget to hit the buttonSave
- Now, you will not be able to access the project settings
Token Access
in project setting sectionCI/CD
. This means that project maintainers will not be able to refine the ci job token access.
https://www.loom.com/share/e3f92c45f99b4c298eb60dfc53dd361f?sid=b0e95b60-6d82-4ed4-a686-f1f2af05ba33
The only workaround (I can think of) is to temporarily enable the project feature CI/CD
and add other projects to the allowlist for the token access. Afterwards, the project feature CI/CD
should be disabled again to restore the old setting. This is cumbersome and seems like an unnecessary work.
It would be better to have direct access to the token access allowlist regardless if the project feature and section CI/CD
is enabled or not.
Proposal
Keep CI/CD menu in navigation, only show Token Access section if CI/CD is disabled.
Our usual practice is to hide the menu item when a feature is disabled, but we have a valid reason here to make an exception for users to access the Token Access even the CI/CD feature is disabled. The consideration is the level of engineering effort required for this change.
Old Proposals
1. Keep Token Access under CI/CD Settings:
-
Option 1a: Keep CI/CD menu in navigation, only show Token Access section if CI/CD is disabled.
- Our usual practice is to hide the menu item when a feature is disabled, but we have a valid reason here to make an exception for users to access the Token Access even the CI/CD feature is disabled. The consideration is the level of engineering effort required for this change.
-
Option 1b: Introduce a third-level control for Token Access under the CI/CD toggle.
- Add a third-level control for Token Access under CI/CD toggle, allowing option to access the Token Access section if CI/CD feature is disabled.
- While this option avoids exceptions to our disable pattern, it adds complexity to our settings control and goes against our Convention over Configuration principle.
2. Move Token Access outside CI/CD Settings:
-
Option 2a: Move Token Access to a logical existing location.
- Choosing the right page to accommodate Token Access is important, as Token Access is best suited under CI/CD in my opinion.
- Users may experience confusion or frustration during the transition as they adjust to the new location of settings.
-
Option 2b: Introduce Token Access as a new second-level menu item under Settings.
- Having Token Access as a separate item under Settings doesn't seem logical to me.
- Proposing navigation changes would need strong evidence, including a solid business case supported by research. Implementing this solution in the short term isn't feasible.
- Move the project settings
Token Access
outside of the project setting sectionCI/CD
in order to make this project setting accessible even when the project featureCI/CD
is disabled. Maybe to the project setting sectionGeneral
,Access Token
orRepository
. - Keep allowing access to only the project setting section
CI/CD
even when the project featureCI/CD
is disabled. Of course, allCI/CD
-related functionalities and features would not work because the project featureCI/CD
is disabled.
Intended users
Project maintainers that want to define which other projects are allowed to access the given project with a ci job token.
Maybe Delaney (Development Team Lead) is the best fitting persona for this proposal.
Feature Usage Metrics
To be defined.
Does this feature require an audit event?
To be defined.