MVC - Backend: Create fields to make query which returns a list of projects where components were used in a pipeline - GraphQL
Target persona
Central team, DevOps team in a large enterprise
Create the following query in GraphQL:
Additional details
Central team in large organizations would receive a list of components & versions used in different project. Which will help them:
- Assess the component usage in their organization
- Visibility into who is using a component version in case a component is outdated or vulnerable
Note: the reason why our users accepting this solution is mainly because that they can script the query and run it over and over again against their different namespaces they have in the organization
Pseudoquery:
catalogResource(componentProjectPath, groupId) {
versions {
components {
projects <- used by these projects which are under the groupId
Implementation details:
- For this query, we only need to to add
projects
undercomponents
, as we already have the other fields available - We should set a limit rate or some sort of limitation to avoid abuse
- Limitation: API should be available for paid users only (GitLab ultimate)
- Permissions: This should only be available to users that have a maintainer+ role on a project
- Timeframe we should hard code the query to return a list of the last 30 days
Context - from Dov:
As an MVC we should consider a first iteration to develop an API that receives a project ID, and a GroupID and returns a list of projects using components , from that project along with their version numbers (we can decide if we want to return ALL project OR project that are not using the latest components version - we should implement the easiest route).
The API must consider project visibility and user permissions, ensuring that users only see projects they have access to.
API Endpoint: (making this up, please feel free to review & revisit)
ProjectId - The ID of the project whose components are being queried.
GroupID - Mandatory where users would need to scope the result to a particular group (helps you scope to an organization), users that invoke the API needs to have a maintainer+ role in the GroupID(we can revisit this going forward)
- The API will check the list of components in the specified project.
✔ - For each component, it will return other projects where the component is used.
✔ - It will return the projects and their component versions where the components are used.
✔ - Project visibility based on user permissions. Users should only see projects they have access to.
✔ - User that invoke the endpoint needs to have a maintainer+ role in the GroupID
- We should set a limit rate or some sort of limitation to avoid abuse
✔ - API should be available for GitLab Ultimate
✔