Remote create submission and the schema connection (monolith/S07 Steps 9-10)

Part of epic &22455 (Repository CRUD, monolith/S07). Covers Steps 9-10 of the Phase 2 (remote) plan, docs/plans/monolith/2026-08-20-repository-crud-remote.md in the artifact-registry repo.

The remote create submission, then the plan's single join: point the three mocked paths at the real schema and delete what stood in for it. Dark behind artifact_registry_ui; no changelog.

This issue mixes two commit types. Step 9 is type::feature and Step 10 is type::maintenance. The issue carries type::feature because it adds behavior. Step 10's own merge request keeps its type::maintenance prefix.

Files sit under ee/app/assets/javascripts/packages_and_registries/artifact_registry/, with Jest specs under ee/spec/frontend/packages_and_registries/artifact_registry/.

Implementation details

Step 9: Remote create submission (type::feature)

  • repositories/create/repositories_create_form.vue (Modify): the remote settings input on the create mutation, and the source section in create mode.
  • repositories/components/remote_source_section.vue (Modify): the create-mode variant, which drops both indicators and the test action. There is no repository behind either, and no endpoint serves a create-form probe.
  • graphql/mutations/create_remote_repository.mutation.graphql (Create): wholly @client on a local-prefixed field, beside the shared hosted document, which the hosted create keeps using.
  • graphql/typedefs.graphql and graphql/mock_resolvers.js (Modify): the local create mutation, its input, and its resolver, including the duplicate-name validation path.
  • constants.js (Modify): the cache-window prefills. New user-facing strings, externalized, with the regenerated locale/gitlab.pot.
  • Name, format, and the upstream URL are marked required, which is AR's requirement rather than the design's.
  • The cache windows show 24 as a hint rather than a submitted value, and an untouched window is omitted from the request. That is what keeps AR's known-immutable rule reachable: S17 defaults the artifact window to 0 when the URL is the format's known-immutable public registry, and an explicit value in the request always wins. A submitted 24 would silently give the most common npm remote 24-hour caching instead of never-revalidate. The form therefore tracks which windows the user edited.

Step 10: Connect the remote write and test paths to the schema (type::maintenance)

  • create_repository.mutation.graphql and update_repository.mutation.graphql (Modify): the settings argument and the credentials-cleared field folded into the shared documents.
  • create_remote_repository.mutation.graphql and update_remote_repository.mutation.graphql (Delete). On test_repository_connection.mutation.graphql, rename the local-prefixed field to the mounted mutation and drop @client. The rename is part of the undo, not only the directive: a local field reusing a mounted name fails the Apollo schema build.
  • graphql/typedefs.graphql and graphql/mock_resolvers.js (Modify): remove this plan's local mutations, inputs, payload types, and resolvers. The local layer itself stays, because other slices still use it.
  • The three form components (Modify): select the shared documents. The Jest specs of plan Steps 7 through 9 (Modify): the documents they assert against. Each assertion is re-targeted rather than rewritten.
  • This step is where AR's gates begin to bite. Before it, the remote write and test flows answer from the mock. After it, they answer from AR, which rejects a non-hosted kind and a settings body until its own steps land. The flag is disabled throughout, so the exposure is to a reviewer rather than a user.

Acceptance

Step 9:

  • A remote create submits kind=remote with the upstream URL and only the cache fields the user edited, so an untouched window reaches AR as an absent key and its known-immutable default still applies.
  • Name, format, and the upstream URL are marked required.
  • The visibility control offers only Private.
  • On success the view navigates with a success toast, and the cached list field is evicted across every filter and sort variant.
  • The create-mode section renders no indicator, no test action, and no cache-eviction action.

Step 10:

  • The remote create and update issue the schema's own mutations with their settings arguments, and the test action issues the mounted mutation.
  • The one surviving local document loses its @client and is validated against the schema, where before it was skipped as a client query. The other two are deleted, and the shared create and update documents were validated all along.
  • No local declaration from this plan remains.
  • The hosted create, update, and delete flows are unchanged, asserted by checking they still select the documents they did before.

Dependencies

  • The Phase 2 plan merge request must merge before any merge request here opens.
  • Step 9 depends on plan Steps 5 and 8, so on both other frontend issues.
  • Step 10 depends on plan Steps 3, 4, 7, 8, and 9, so on every other issue in this epic. It is the plan's one join.
  • Step 10 may merge before either AR contract gate clears. The connected paths then surface AR's rejection as a payload error.

Not in scope

Two S07 surfaces the plan deliberately omits, recorded so nobody reads this issue as having covered them:

  • The create-form test action. It needs an AR endpoint that probes a supplied URL with no repository behind it, and no spec contracts one. AR's only test route is repository-scoped. Raising this with the AR team is tracked separately.
  • Binding a duplicate-name error to the name input. Phase 1 renders payload errors through the shared summary alert, with no path from a server error to a field. Closing that would mean editing the shared form and rewriting a passing spec for every kind at once, which is neither remote-shaped nor this phase's.