Ability to start Duo Workflow From GitLab UI triggering CI pipeline
Read about the CI pipeline architecture in https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/duo_workflow/#ci-pipeline-architecture
We did an early POC in !153551 (closed) with a demo at https://www.youtube.com/watch?v=v8WWZuAGXMU .
For this issue we need to add:
- A UI in GitLab (using the same shared UI components used in the IDE) for starting a workflow
- When starting the workflow we need to start a CI pipeline with all the workflow data as environment variables . It will need to start a docker container with
duo-workflow-executor
running in it. We might consider allowing the user to configure the docker image used.
We can use inpiration from the way CI pipelines are dynamically constructed for DAST pipelines in https://gitlab.com/gitlab-org/gitlab/-/blob/19e0669446f55bd29a8df29174d3b0379b8e22c2/ee/app/services/app_sec/dast/site_validations/runner_service.rb#L11 and do something similar so that we don't need a .gitlab-ci.yml
file to be defined anywhere.
As we expect longer term the users will want to be able to configure the base docker image we shouldn't rely on any docker image that includes the duo-workflow-executor
. Instead the CI job should add a script
that downloads the latest duo-workflow-executor
release and runs it.