Indirect Members Cannot See Available Runners in CI/CD Settings

Description:

Indirect members (those who are members of a project via group invite) cannot see available runners in the CI/CD settings. This occurs even when the runners are not locked to the project.

Steps to Reproduce:
  1. Create project X and Y.
  2. Create a user Ricarda and put them in Group A.
  3. Add Group A as a maintainer to project X and Y.
  4. Create a project runner in project X.
  5. Ensure that this project runner is not locked to project X.
  6. User Ricarda, as maintainer of X and Y, should be able to enable the project runner in the CI/CD settings of project Y, but cannot, as the runner is not shown.

Expected Behavior:

  • Indirect members should be able to see all available runners in the CI/CD settings, provided the runners are not locked to any specific project.

Actual Behavior:

  • Indirect members cannot see any available runners in the CI/CD settings, despite the runners not being locked to the project. Impact:This bug affects the visibility of runners for indirect members, potentially hindering their ability to configure and utilize CI/CD runners effectively.

Technical Proposal

Our query to list runners that as assignable to a given project depend on the current_user.

        current_user
          .ci_owned_runners
          .assignable_for(project)

This query, in turn, doesn't account for indirect memberships in projects, this leads the situation where users don't see the runners they expect.

Note by @mrincon: An updated query that accounts from this could be rather complex so I'll place this workflowsolution validation so we can check if it is feasible to build it.

Edited by 🤖 GitLab Bot 🤖