Add admin_cicd_variables custom ability

What does this MR do and why?

This allows admin access to CI/CD variables as a customizable ability, so that it can be added onto any base role.

This adds the policy. The policy is applied in other MR's (here and here).

Issue: #437947 (closed)

changed milestone to %16.9

added Category:Permissions devopsgovern featureaddition groupauthorization sectionsec typefeature labels

assigned to @alexbuijs

marked this merge request as draft

added backend database databasereview pending labels

	2 Messages
📖	CHANGELOG missing: If this merge request needs a changelog entry, add the Changelog trailer to the commit message you want to add to the changelog. If this merge request doesn't need a CHANGELOG entry, feel free to ignore this message.
📖	This merge request adds or changes documentation files. A review from the Technical Writing team before you merge is recommended. Reviews can happen after you merge.

Documentation review

The following files require a review from a technical writer:

• doc/api/graphql/reference/index.md (Link to current live version)

The review does not need to block merging this merge request. See the:

• Metadata for the *.md files that you've changed. The first few lines of each *.md file identify the stage and group most closely associated with your docs change.
• The Technical Writer assigned for that stage and group.
• Documentation workflows for information on when to assign a merge request for review.

Reviewer roulette

Category	Reviewer	Maintainer
backend	@ghinfey (UTC+0, 1 hour behind author)	@kassio (UTC+0, 1 hour behind author)
database	@bala.kumar (UTC+5.5, 4.5 hours ahead of author)	@ghavenga (UTC+2, 1 hour ahead of author)
~"Authorization"	Reviewer review is optional for ~"Authorization"	@jarka (UTC+1, same timezone as author)
~"Authentication"	Reviewer review is optional for ~"Authentication"	@sgarg_gitlab (UTC+5.5, 4.5 hours ahead of author)

Please check reviewer's status!

• Reviewer is available!
• Reviewer is unavailable!

Please refer to documentation page for guidance on how you can benefit from the Reviewer Roulette, or use the GitLab Review Workload Dashboard to find other available reviewers.

If needed, you can retry the 🔁 danger-review job that generated this comment.

Generated by 🚫 Danger

E2E Test Result Summary

allure-report-publisher generated test report!

e2e-test-on-gdk: ✅ test report for 7d310e01

expand test summary

+------------------------------------------------------------------+
|                          suites summary                          |
+-------------+--------+--------+---------+-------+-------+--------+
|             | passed | failed | skipped | flaky | total | result |
+-------------+--------+--------+---------+-------+-------+--------+
| Plan        | 4      | 0      | 0       | 0     | 4     | ✅     |
| Package     | 0      | 0      | 1       | 0     | 1     | ➖     |
| Monitor     | 4      | 0      | 0       | 0     | 4     | ✅     |
| Govern      | 65     | 0      | 1       | 0     | 66    | ✅     |
| Create      | 8      | 0      | 3       | 0     | 11    | ✅     |
| Data Stores | 0      | 0      | 2       | 0     | 2     | ➖     |
+-------------+--------+--------+---------+-------+-------+--------+
| Total       | 81     | 0      | 7       | 0     | 88    | ✅     |
+-------------+--------+--------+---------+-------+-------+--------+

e2e-package-and-test: ✅ test report for 7d310e01

expand test summary

+------------------------------------------------------------------+
|                          suites summary                          |
+-------------+--------+--------+---------+-------+-------+--------+
|             | passed | failed | skipped | flaky | total | result |
+-------------+--------+--------+---------+-------+-------+--------+
| Govern      | 271    | 0      | 22      | 1     | 293   | ✅     |
| Create      | 148    | 0      | 24      | 4     | 172   | ✅     |
| Monitor     | 8      | 0      | 0       | 0     | 8     | ✅     |
| Package     | 0      | 0      | 2       | 0     | 2     | ➖     |
| Data Stores | 0      | 0      | 4       | 0     | 4     | ➖     |
| Plan        | 8      | 0      | 0       | 0     | 8     | ✅     |
+-------------+--------+--------+---------+-------+-------+--------+
| Total       | 435    | 0      | 52      | 5     | 487   | ✅     |
+-------------+--------+--------+---------+-------+-------+--------+

Database migrations (on the main database)

Migrations included in this change have been executed on gitlab.com data for testing purposes. For details, please see the migration testing pipeline (limited access).

Migration	Type	Total runtime	Result	DB size change
20240131123824 - AddAdminCicdVariablesToMemberRoles	Regular	1.7 s	✅	+0.00 B

Runtime Histogram for all migrations

Query Runtime	Count
0 seconds - 0.01 seconds	0
0.01 seconds - 0.1 seconds	4
0.1 seconds - 1 second	0
1 second - 5 seconds	0
5 seconds - 15 seconds	0
15 seconds - 5 minutes	0
5 minutes +	0

Migration: 20240131123824 - AddAdminCicdVariablesToMemberRoles

• Type: Regular
• Duration: 1.7 s
• Database size change: +0.00 B

Calls	Total Time	Max Time	Mean Time	Rows	Query
1	12.2 ms	12.2 ms	12.2 ms	0	ALTER TABLE "member_roles" ADD "admin_cicd_variables" boolean DEFAULT FALSE NOT NULL
1	0.0 ms	0.0 ms	0.0 ms	1	SELECT $1::regtype::oid
2	0.0 ms	0.0 ms	0.0 ms	2	SELECT pg_backend_pid()

Histogram for AddAdminCicdVariablesToMemberRoles

Query Runtime	Count
0 seconds - 0.01 seconds	0
0.01 seconds - 0.1 seconds	4
0.1 seconds - 1 second	0
1 second - 5 seconds	0
5 seconds - 15 seconds	0
15 seconds - 5 minutes	0
5 minutes +	0

Other information

Other migrations pending on GitLab.com

Migration	Type	Total runtime	Result	DB size change
20240115185037 - CreatePackagesTerraformModuleMetadata	Regular	2.2 s	⚠	+40.00 KiB
20240122155430 - RemoveZoektIndexedNamespacesForeignKeys	Post deploy	2.7 s	⚠	+0.00 B
20240122155541 - DropZoektIndexedNamespacesTable	Post deploy	1.7 s	✅	-112.00 KiB
20240123102735 - UpdateNegativeStarCountsInProjects	Post deploy	2.2 s	✅	+0.00 B
20240123102745 - AddStarCountPositiveConstraintToProjects	Post deploy	2.4 s	✅	+0.00 B
20240123120413 - IndexSbomOccurrencesOnProjectIdComponentVersionIdAndInputFilePath	Post deploy	377.1 s	✅	-425.12 MiB
20240124105532 - FinalizeBackfillOwaspTopTenOfVulnerabilityReads	Post deploy	1.8 s	✅	+0.00 B
20240131000657 - PrepareAsyncIndexForPCiBuildsPart2	Post deploy	10.1 s	✅	+0.00 B

Clone details

Clone ID	Clone Created At	Clone Data Timestamp	Expected Removal Time
database-testing-2810711-12688177-main	2024-01-31T14:38:12Z	2024-01-31T10:51:51Z	2024-02-01 02:49:31 +0000
database-testing-2810711-12688177-ci	2024-01-31T14:38:12Z	2024-01-31T12:46:43Z	2024-02-01 02:49:31 +0000

Job artifacts

Database migrations (on the ci database)

Migrations included in this change have been executed on gitlab.com data for testing purposes. For details, please see the migration testing pipeline (limited access).

Migration	Type	Total runtime	Result	DB size change
20240131123824 - AddAdminCicdVariablesToMemberRoles	Regular	2.7 s	✅	+0.00 B

Runtime Histogram for all migrations

Query Runtime	Count
0 seconds - 0.01 seconds	0
0.01 seconds - 0.1 seconds	4
0.1 seconds - 1 second	0
1 second - 5 seconds	0
5 seconds - 15 seconds	0
15 seconds - 5 minutes	0
5 minutes +	0

Migration: 20240131123824 - AddAdminCicdVariablesToMemberRoles

• Type: Regular
• Duration: 2.7 s
• Database size change: +0.00 B

Calls	Total Time	Max Time	Mean Time	Rows	Query
1	45.7 ms	45.7 ms	45.7 ms	0	ALTER TABLE "member_roles" ADD "admin_cicd_variables" boolean DEFAULT FALSE NOT NULL
1	0.0 ms	0.0 ms	0.0 ms	1	SELECT $1::regtype::oid
2	0.0 ms	0.0 ms	0.0 ms	2	SELECT pg_backend_pid()

Histogram for AddAdminCicdVariablesToMemberRoles

Query Runtime	Count
0 seconds - 0.01 seconds	0
0.01 seconds - 0.1 seconds	4
0.1 seconds - 1 second	0
1 second - 5 seconds	0
5 seconds - 15 seconds	0
15 seconds - 5 minutes	0
5 minutes +	0

Other information

Other migrations pending on GitLab.com

Migration	Type	Total runtime	Result	DB size change
20240115185037 - CreatePackagesTerraformModuleMetadata	Regular	3.8 s	⚠	+24.00 KiB
20240131000657 - PrepareAsyncIndexForPCiBuildsPart2	Post deploy	11.1 s	✅	+0.00 B

Clone details

Clone ID	Clone Created At	Clone Data Timestamp	Expected Removal Time
database-testing-2810711-12688177-main	2024-01-31T14:38:12Z	2024-01-31T10:51:51Z	2024-02-01 02:49:31 +0000
database-testing-2810711-12688177-ci	2024-01-31T14:38:12Z	2024-01-31T12:46:43Z	2024-02-01 02:49:31 +0000

Job artifacts

---

Brought to you by gitlab-org/database-team/gitlab-com-database-testing. Epic

added database-testing-automation label

added 276 commits

• b442cdc9...97ad7aa3 - 275 commits from branch master
• d2afb4a5 - Add admin_cicd_variables custom ability

Compare with previous version

added documentation frontend labels

Bundle size analysis [beta]

This compares changes in bundle size for entry points between the commits 7d99af84 and 05a64c10

✨ Special assets

Entrypoint / Name	Size before	Size after	Diff	Diff in percent
average	4.13 MB	4.13 MB	-	0.0 %
mainChunk	3.13 MB	3.13 MB	-	0.0 %

---

Note: We do not have exact data for 7d99af84. So we have used data from: 0450b001.
The intended commit has no webpack pipeline, so we chose the last commit with one before it.

Please look at the full report for more details

---

Read more about how this report works.

Generated by 🚫 Danger

added 248 commits

• d2afb4a5...72f669eb - 245 commits from branch master
• 29526605 - Add admin_cicd_variables custom ability
• 321b9be9 - Allow managing group CI/CD variables
• 62406e06 - Allow managing project CI/CD variables

Compare with previous version

added 436 commits

• 62406e06...bb28dfbc - 433 commits from branch master
• 8eeb8e7d - Add admin_cicd_variables custom ability
• 8935a7b8 - Allow managing group CI/CD variables
• 05a64c10 - Allow managing project CI/CD variables

Compare with previous version

added 362 commits

• 05a64c10...6b895892 - 361 commits from branch master
• 219dfd01 - Add admin_cicd_variables custom ability

Compare with previous version

added feature flag label

mentioned in issue #440834

added 1 commit

• 6c41599b - Add admin_cicd_variables custom ability

Compare with previous version

added 191 commits

• 6c41599b...8b4ed95b - 190 commits from branch master
• dda67801 - Add admin_cicd_variables custom ability

Compare with previous version

added 1 commit

• bbbad383 - Add admin_cicd_variables custom ability

Compare with previous version