[FF] ci_pipelines_for_mr_single_project_scope: fork MR pipeline count scoping

Summary

Roll out the fork merge request pipeline count fix currently behind the ci_pipelines_for_mr_single_project_scope feature flag.

The flag gates a query-shape change in Ci::PipelinesForMergeRequestFinder for the two partial-permission paths (a viewer who can read pipelines on only one of the fork or target projects). With the flag disabled, the finder keeps the current production query. With it enabled, the merge-request-event pipelines are scoped to the single authorized project by equality (project_id = <project>), which lets the planner use the selective merge_request_id index instead of scanning the whole project. See !260777 (merged) for the query plans. Results are identical in every permission case; only the query shape changes.

• DRI: @pgumeson
• Team Slack channel: #g_pipeline-execution_engineering

Note

Process and guidance live in the docs. This issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability, which is not the same as releasing the feature (that happens when the flag is removed). Feature flag controls and feature flag lifecycle

What could go wrong?

The change is on p_ci_pipelines, one of the largest tables. The risk is a query-plan regression on projects whose statistics differ from the ones measured on Database Lab. Blast radius is limited to the merge request pipelines list and count on fork MR pages for partial-permission viewers; results are unchanged, so the failure mode is latency, not correctness. Watch the merge requests controller and GraphQL latency, and the statement-timeout rate on p_ci_pipelines, on https://dashboards.gitlab.net.

Events

(Observe exceptions and events for ci_pipelines_for_mr_single_project_scope:1 in Kibana per the standard FF observability links.)

Rollout

Run all production /chatops in #production and cross-post to the team channel.

Non-production

/chatops gitlab run feature set ci_pipelines_for_mr_single_project_scope 50 --actors --dev --pre --staging --staging-ref
/chatops gitlab run feature set ci_pipelines_for_mr_single_project_scope true --dev --pre --staging --staging-ref

Production (percentage rollout, wait at least 15 min between steps, watch dashboards):

/chatops gitlab run feature set ci_pipelines_for_mr_single_project_scope <percentage> --actors

Or target specific actors instead:

/chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss ci_pipelines_for_mr_single_project_scope true
/chatops gitlab run feature set --group=gitlab-org,gitlab-com ci_pipelines_for_mr_single_project_scope true

Cleanup

Remove the flag once deemed stable. Remove the flag and its YAML definition from the codebase, then:

/chatops gitlab run release check <merge-request-url> <milestone>
/chatops gitlab run feature delete ci_pipelines_for_mr_single_project_scope --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set ci_pipelines_for_mr_single_project_scope false                                         # production
/chatops gitlab run feature set ci_pipelines_for_mr_single_project_scope false --dev --pre --staging --staging-ref     # non-production