Skip to content

Move secrets check out of push rules namespace

What does this MR do and why?

This merge request moves the newly introduced secrets push check out of the push rules namespace because:

  1. It doesn't really depend on the existence of a push rule for the project.
  2. It shouldn't be under the namespace for the reason above.

Why are we making this change?

Okay, some history, when we started to work on the experimental phase of pre-receive secret detection there were some ideas thrown on the possibility of using push rules to toggle this feature on and off, however, due to the way this feature was developed (i.e. Gitlab Dedicated-first), we had to use an instance-level application setting instead.

Nevertheless, the code didn't reflect that change in direction properly, but @rossfuhrman and I have discussed moving it out of the PushRules namespace and not checking for existence of a push rule a couple of times.

Depsite that, we didn't make an explicit decision until now, thanks to this question from @jwoodwardgl who happened to be putting together a guide on developing push rule checks.

How is this going to affect the user experience?

This feature is yet to be used by any customers or users, but it had been included in %16.7, so Dedicated customers would have the ability to start using it when they upgrade to that milestone (sometime next January). It is important to note that the impact from UX point of view here would be minimal, a user initially would have had to make sure a push rule record existed for the project which they are pushing to, in order for secrets detection to take place. With this change, they no longer would have to.

Edited by Ahmed Hemdan

Merge request reports