Skip to content

Job with custom stage not included in pipeline enforced via Pipeline Execution Policy

Summary

When using the override_project_ci strategy and including the projects own CI configuration as documented, a job defined in the project's CI/CD configuration won't be included in the resulting pipeline if it uses a non-default stage name.

Steps to reproduce

  1. Create a project for the compliance pipeline YAML

  2. Create compliance.yml with the following content:

    include:
      - project: $CI_PROJECT_PATH
        ref: $CI_COMMIT_SHA
        file: $CI_CONFIG_PATH
  3. Configure this as a group level Pipeline Execution Policy, example policy YAML:

    name: test_pep
    description: ''
    enabled: true
    pipeline_config_strategy: override_project_ci
    content:
      include:
      - project: gl-demo-ultimate-mgrabowski/i-494431-compliance
        ref: main
        file: compliance.yml
    policy_scope:
      compliance_frameworks:
      - id: 1019736
  4. Create a new project

  5. Apply the compliance framework from the above policy to it

  6. Add the following .gitlab-ci.yml

    stages:
      - one
      
    testjob1:
      stage: one
      script: echo "test"
  7. Observe getting an empty pipeline

  8. Change the stage name from one to e.g. build or test

  9. Observe getting a pipeline with the job included

Example Project

What is the current bug behavior?

The job with custom stage name is not included in the enforced pipeline.

What is the expected correct behavior?

The job with custom stage name is included in the enforced pipeline.

Relevant logs and/or screenshots

Output of checks

This bug happens on GitLab.com

Proposed Fixes/Improvements

  1. Provide guidance to users in the UI to ensure they understand the impact of their configuration for the pipeline execution policy, including the behavior to expect when using project:include. Carried forward in Helper text for pipeline execution policy confi... (#505534).
Current Proposed
image image
  1. Functional changes in #475152 (closed) (outside of the scope of this issue) will ensure custom stages can also be injected using a pipeline execution policy. Unrelated to this issue

  2. Fix in this issue -- update pipeline execution policies to enforce required stages in override mode, similar to compliance pipelines. Stages declared in override_project_ci policies will be used when injecting policy jobs. If multiple override policies are in place, the stages need to be compatible with each other - they have to be declared in the same relative order. See documentation for more details.

Edited by Martin Čavoj