Opt-in RSpec guard for cloud URL resolution on an offline license

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

@treagitlab, would gl-dx take an opt-in RSpec guard for offline-license examples that resolve a cloud URL? It is about 150 lines in ee/spec/support, off by default, and raised nothing on 27,956 default-license examples. I can build it under your guidance.

Problem to solve

No shared check fails when an offline-license example resolves a GitLab cloud host. WebMock blocks real connections, but a spec that stubs the cloud URL passes on any license. A new call path passes the suite, then fails on an instance without internet access.

Proposal

  • Add ee/spec/support/offline_egress_guard.rb, installed only with OFFLINE_EGRESS_GUARD=1.
  • Add one metadata key, :allow_offline_egress, to known_rspec_metadata_keys.yml so an example can opt out.
  • The guard raises only when License.current.offline_cloud_license? holds at call time.
  • It reports a resolution, not a packet. Workhorse, gRPC and the Python gateway are outside it.

Where the guard sits

flowchart TD
  A["spec example"] --> B["code resolves a cloud URL<br/>Gitlab::AiGateway or Gitlab::DuoWorkflow::Client, or sends an HTTP request"]
  B --> C{"OFFLINE_EGRESS_GUARD=1"}
  C -- no --> D["allow"]
  C -- yes --> E{"License.current.offline_cloud_license?"}
  E -- no --> D
  E -- yes --> F{"cloud host and no :allow_offline_egress tag"}
  F -- no --> D
  F -- yes --> G["raise OfflineEgressError<br/>names the URL, resolver, caller and example"]

What I measured

  • Online license, guard installed: 0 guard errors over 27,956 examples. They came from 1,465 AI and cloud connector spec files under ee/spec.
  • Offline license, guard installed: 1,100 examples that pass without the guard failed, in 68 spec files. Those files need fixing or allowlisting before a job could gate on them.

Later: an offline-license job

  • Not proposed yet: in 45 of the 68 files, product code resolves a cloud URL. Those sites need a fix or a tag first.
  • The offline license alone fails specs unrelated to egress, so a job should count guard errors only.
  • One serial run over the 1,465 files took about 100 minutes.

An AI coding assistant wrote this issue. The assistant also checked each claim against the code cited here and ran the measurements on test VMs.

Edited by 🤖 GitLab Bot 🤖