[FF] audit_ci_variable_value_access -- Audit successful CI/CD variable value access in GraphQL

Summary

Roll out the feature currently behind the audit_ci_variable_value_access feature flag.

Note

Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. Feature flag controls · Feature flag lifecycle

What could go wrong?

The flag gates a variable_viewed_graphql audit event, emitted when a GraphQL query reads CI/CD variable value fields. The event is streamed only (saved_to_database: false), so it never appears in the Audit Events UI. It reaches external streaming destinations configured on the project, an ancestor group, or the instance. It is emitted once per query per variable owner (project or group), not once per variable, from a GraphQL tracer that runs after query execution. The key list per owner is capped at 100, with truncated: true set beyond that. Blast radius is limited to extra audit event streaming volume and a small amount of work at the end of such queries. Watch audit event streaming throughput and GraphQL/Rails request latency on https://dashboards.gitlab.net.

Rollout

Run all production /chatops in #production and cross-post the results to the team channel. Background: incremental rollout process, feature actors.

Non-production

/chatops gitlab run feature set audit_ci_variable_value_access 50 --actors --dev --pre --staging --staging-ref
/chatops gitlab run feature set audit_ci_variable_value_access true --dev --pre --staging --staging-ref

Production — percentage rollout (wait ≥15 min between steps, watch dashboards):

/chatops gitlab run feature set audit_ci_variable_value_access <percentage> --actors

Or target specific actors instead. The actor is the requesting user, so --actors percentages are percentage-of-users and only --user= targeting works:

/chatops gitlab run feature set --user=oyakovenko-ext audit_ci_variable_value_access true

Before global rollout

Confirm the relevant gotchas before going to 100% — see enabling a feature for GitLab.com:

Cleanup

Remove the flag once deemed stable — see cleaning up. Remove the flag and its YAML definition from the codebase, then:

/chatops gitlab run release check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/240847 <milestone>
/chatops gitlab run feature delete audit_ci_variable_value_access --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set audit_ci_variable_value_access false                                         # production
/chatops gitlab run feature set audit_ci_variable_value_access false --dev --pre --staging --staging-ref     # non-production
/chatops gitlab run feature delete audit_ci_variable_value_access --dev --pre --staging --staging-ref --production  # remove entirely
Edited by Oleg Yakovenko