Skip to content

Ability to start Duo Workflow From GitLab UI triggering CI pipeline

Read about the CI pipeline architecture in https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/duo_workflow/#ci-pipeline-architecture

We did an early POC in !153551 (closed) with a demo at https://www.youtube.com/watch?v=v8WWZuAGXMU .

For this issue we need to add:

  1. A UI in GitLab (using the same shared UI components used in the IDE) for starting a workflow
  2. When starting the workflow we need to start a CI pipeline with all the workflow data as environment variables . It will need to start a docker container with duo-workflow-executor running in it. We might consider allowing the user to configure the docker image used.

We can use inpiration from the way CI pipelines are dynamically constructed for DAST pipelines in https://gitlab.com/gitlab-org/gitlab/-/blob/19e0669446f55bd29a8df29174d3b0379b8e22c2/ee/app/services/app_sec/dast/site_validations/runner_service.rb#L11 and do something similar so that we don't need a .gitlab-ci.yml file to be defined anywhere.

As we expect longer term the users will want to be able to configure the base docker image we shouldn't rely on any docker image that includes the duo-workflow-executor. Instead the CI job should add a script that downloads the latest duo-workflow-executor release and runs it.

Edited by Dylan Griffith