Skip to content

Add new section for secret detection in admin settings

What does this MR do and why?

This introduces the UI for toggling the pre_receive_secret_detection_enabled application setting from !135032 (merged).

The design and text copy used in the merge request is derived from:

#428637 (closed)Secret_detection_-pre-receive_scanning-instance-level_configuration-_enabled.png.

Resolves #428761 (closed), and built on top of !135164 (merged), !135036 (merged), and !135032 (merged).

Feature flags

The new section is behind a feature flag secret_detection_application_setting to ensure it's not displayed for customers when this is merged to master. A roll-out issue has been created to track rolling out the new section to users.

Additionally, there's the pre_receive_secret_detection_push_check feature flag introduced earlier in !135032 (merged) that ensures the actual secrets check does not run unless the flag is turned on for a particular project.

Related merge requests

Step Merge Request Description
1 !135032 (merged) Adds the secrets push check, and puts it behind a feature flag.
2 !135036 (merged) Updates the secrets push check to check for license (only ultimate is allowed).
3 !135164 (merged) Adds a new application setting for pre-receive SD, and updates the secrets push check accordingly.
4 This one. Adds the UI for toggling the application setting of pre-receive SD

Why are we introducing a feature flag and an application setting at the same time?

In the related merge requests (as shown above), we introduce an application setting (configurable via the UI) in addition to the feature flag introduced in this merge request, the reason is because this feature is planned for GitLab Dedicated first, and then for other types of instances.

GitLab Dedicated, however, does not support feature flags, and since this is an experimental feature at the moment, the solution is to put the feature behind an application setting (introduced in step number 3) for dedicated instances, and for all other types to have the feature behind the same application setting and a feature flag enabled per project.

Please read more about this decision in this thread.

How to set up and validate locally

  • In your rails console, enable secret_detection_application_setting feature flag:
pry(main)> Feature.enable(:secret_detection_application_setting)
pry(main)> Gitlab::CurrentSettings.pre_receive_secret_detection_enabled

Screenshots or screen recordings

Description Screenshot
Section collapsed Screenshot_2023-10-27_at_8.47.03_PM
Section expanded Screenshot_2023-10-27_at_8.47.13_PM

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Ahmed Hemdan

Merge request reports