Skip to content

Add ability to strictly enforce stage order when running jobs from Pipeline Execution Policies

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Problem Statement

Pipeline Execution Policies currently face challenges when enforcing stage order due to the needs keyword in GitLab CI configuration. The needs keyword allows jobs to run out of their defined stage order, which creates issues for security policies that need to ensure strict sequential execution.

This affects multiple use cases identified in our Pipeline Execution Policy Stage Control epic:

Root Cause

All three cases share the same root cause: the needs keyword affects how jobs are executed, allowing jobs to bypass the natural stage order. While jobs without the needs keyword execute in parallel within their stage, stages themselves should run sequentially. However, when needs is used, this sequential stage execution can be bypassed.

Current Behavior vs Desired Behavior

Current Behavior:

  • Jobs with needs keyword can run out of stage order
  • Pipeline Execution Policies cannot guarantee sequential stage execution
  • Security policies may be bypassed when developers use needs in their CI configuration

Desired Behavior:

  • Pipeline Execution Policies can enforce strict stage order regardless of needs configuration
  • When enabled, stages run sequentially even if individual jobs have needs dependencies
  • Existing Pipeline Execution Policy configurations continue to work as before

Proposed Solution

Add a new configuration option within Pipeline Execution Policies that allows strict enforcement of stage order. This option would:

  1. Ignore needs keyword for the purpose of stage ordering when enabled
  2. Ensure sequential stage execution regardless of job-level dependencies
  3. Apply to all jobs when enabled (initially - can be extended for selective enforcement in the future)
  4. Maintain backward compatibility with existing Pipeline Execution Policy configurations

Implementation Approach

This requires collaboration between the Verify stage (GitLab CI functionality) and Security Risk Management (Pipeline Execution Policies) teams:

  • Verify team: Implement the core CI functionality to override needs behavior when requested
  • Security Risk Management team: Add the configuration option to Pipeline Execution Policies to leverage this functionality
  • Cross-team coordination: Ensure the feature integrates seamlessly with existing policy enforcement mechanisms

Acceptance Criteria

  • Pipeline Execution Policies can be configured to enforce strict stage order
  • When enabled, stages execute sequentially regardless of needs keyword usage
  • Existing Pipeline Execution Policy configurations remain unaffected
  • Feature works with all current policy enforcement mechanisms
  • Documentation updated to explain the new configuration option

Related Issues

Edited by 🤖 GitLab Bot 🤖