[FF] log_ci_variable_value_access -- Log successful CI/CD variable value access in GraphQL

Summary

Roll out the feature currently behind the log_ci_variable_value_access feature flag.

• DRI: @oyakovenko-ext
• Team Slack channel: #g_pipeline-authoring

Note

Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. Feature flag controls · Feature flag lifecycle

What could go wrong?

The flag gates additional structured logging (query_analysis.successfully_accessed_vars) emitted during GraphQL resolution of CI/CD variable value fields. Blast radius is limited to GraphQL log volume/size for queries that read CI/CD variable values. Watch GraphQL logging and Rails request dashboards on https://dashboards.gitlab.net for log-volume or latency regressions.

Rollout

Run all production /chatops in #production and cross-post the results to the team channel. Background: incremental rollout process, feature actors.

Non-production

/chatops gitlab run feature set log_ci_variable_value_access 50 --actors --dev --pre --staging --staging-ref
/chatops gitlab run feature set log_ci_variable_value_access true --dev --pre --staging --staging-ref

Production — percentage rollout (wait ≥15 min between steps, watch dashboards):

/chatops gitlab run feature set log_ci_variable_value_access <percentage> --actors

Or target specific actors instead:

/chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss log_ci_variable_value_access true
/chatops gitlab run feature set --group=gitlab-org,gitlab-com log_ci_variable_value_access true
/chatops gitlab run feature set --user=oyakovenko-ext log_ci_variable_value_access true

Before global rollout

Confirm the relevant gotchas before going to 100% — see enabling a feature for GitLab.com:

• Docs + version history updated
• Breaking changes announced, if any
• Change management issue opened, if required
• External API consumers handled with a fail-open mechanism, if applicable

Cleanup

Remove the flag once deemed stable — see cleaning up. Remove the flag and its YAML definition from the codebase, then:

/chatops gitlab run release check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/240847 <milestone>
/chatops gitlab run feature delete log_ci_variable_value_access --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set log_ci_variable_value_access false                                         # production
/chatops gitlab run feature set log_ci_variable_value_access false --dev --pre --staging --staging-ref     # non-production
/chatops gitlab run feature delete log_ci_variable_value_access --dev --pre --staging --staging-ref --production  # remove entirely