S - Docs updates for Downstream (Multi-Project) Pipelines
The Problem
We currently let people configure a downstream multi-project Pipeline with a simple text reference to the namespace and project name of the downstream Project:
trigger_job:
trigger:
project: project-group/my-downstream-project
When this happens, we check permissions in the downstream Project by passing the currently authenticated user into the CreatePipelineService, which then does the regular creation sequence check of that users permissions before running the Pipeline.
If a User is conceptually belongs to a Project in each cell, they might expect to be authenticated against each cell at the same time, and so would expect to be able to trigger a downstream Pipeline in another cell. It is my understanding that this will not be possible, even just querying the Project, never mind the bit about seamless authentication.
What to do about it
I (currently) have no idea what multi-cell authentication is going to look like, or if it will even be possible, but I can imagine two outcomes:
-
If we are going to tell users that they have to authenticate separately into different cells (even if it's more Product-y, like "You have to authenticate separately into your managed-dedicated private Organization", which happens to live on the other cell) then I don't think they'll expect to be able to seamless create Downstream multi-project Pipelines, and we don't need to refactor anything. But we will probably need to write new documentation for a recommended workflow for creating downstream Pipelines via authenticated request over some public-API-ish functionality.
-
If we want to tell Users that they can be authenticated as a single entity against multiple Cells at one time, we'll probably need to refactor something in the downstream multi-project Pipeline workflow to work more like an external API, and send an authenticable request that can be routed to a Project in the other cell, and successfully create a Pipeline over there.
Next Steps
Per the note in #444239 (comment 1840378528), the intention of this issue is to make an update in our docs for the Cells 1.0 to clarify that cross-org CI will not be available. Organizations being public AND private together in Cells won't happen until Cells 2.0 according to the roadmap defined here.
**T-Shirt Effort Level: Small (1) **