[FF] `chatgpt_siwc_login_redirect` -- Roll out SIWC OAuth login-page bypass

Summary

Roll out the SIWC (sign in with ChatGPT) OAuth login-page bypass currently behind the chatgpt_siwc_login_redirect feature flag.

When ChatGPT sends an unauthenticated user to /oauth/authorize with target_flow=chatgpt_siwc, GitLab redirects them into the ChatGPT OmniAuth sign-in instead of showing the generic GitLab login page.

DRI: @leetickett-gitlab
Team Slack channel: #g_authentication

Note

Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. Feature flag controls · Feature flag lifecycle

What could go wrong?

Blast radius: limited to the unauthenticated /oauth/authorize path when target_flow=chatgpt_siwc is present. Users already signed in to GitLab, and all other OAuth flows, are unaffected.
Failure mode: the change only alters where an unauthenticated user is redirected (ChatGPT OmniAuth vs. the GitLab login page). A spoofed target_flow can only bounce an unauthenticated user to ChatGPT's login — no data exposure and no open redirect (the target is a fixed provider path).
Dependency: relies on the chatgpt OmniAuth provider (added in !239762 (merged)) being configured on the instance.

Rollout

Run all production /chatops in #production and cross-post the results to #g_authentication. Background: incremental rollout process, feature actors.

Non-production

/chatops gitlab run feature set chatgpt_siwc_login_redirect true --dev --pre --staging --staging-ref

Production — this flag uses :instance as its actor, so enable it globally once validated on non-production:

/chatops gitlab run feature set chatgpt_siwc_login_redirect true

Before global rollout

Confirm the relevant gotchas before going to 100% — see enabling a feature for GitLab.com:

Docs + version history updated
Breaking changes announced, if any
Change management issue opened, if required
External API consumers handled with a fail-open mechanism, if applicable
Partner (ChatGPT/OpenAI) has confirmed the flow meets their expectations

Cleanup

Remove the flag once deemed stable — see cleaning up. Track it here, or open a follow-up Feature Flag Cleanup issue. Remove the flag and its YAML definition from the codebase, then:

/chatops gitlab run release check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/247672 <milestone>
/chatops gitlab run feature delete chatgpt_siwc_login_redirect --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set chatgpt_siwc_login_redirect false                                         # production
/chatops gitlab run feature set chatgpt_siwc_login_redirect false --dev --pre --staging --staging-ref     # non-production
/chatops gitlab run feature delete chatgpt_siwc_login_redirect --dev --pre --staging --staging-ref --production  # remove entirely

🤖 This content was generated by GitLab Duo.

[FF] chatgpt_siwc_login_redirect -- Roll out SIWC OAuth login-page bypass