Add `admin_runners` custom role permission
What does this MR do and why?
This change introduces a new custom permission to allow users the ability to manage runners for a group or project.
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Before | After |
---|---|
![]() ![]() |
![]() ![]() ![]() ![]() ![]() ![]() |
How to set up and validate locally
- In rails console enable the experiment fully
Feature.enable(:custom_ability_admin_runners)
- Create a role with the
Admin Runners
permission enabled. - Assign the new role to a new user
- Login with the new user
- Visit any project page and ensure that the
Settings
menu item appears in the navigation. - Click on the
Settings
menu and ensure that theCI/CD
menu item appears. - Click on the
CI/CD
menu. - Ensure that the
Runners
section appears. - Click on
Expand
- Ensure that the list of runners are displayed.
Merge request reports
Activity
changed milestone to %17.1
added backend featureaddition groupauthorization labels
assigned to @mokhax
added typefeature label
added Category:Permissions devopsgovern sectionsec labels
added 2 commits
- A deleted user
added documentation label
1 Warning The master pipeline status page reported failures in If these jobs fail in your merge request with the same errors, then they are not caused by your changes.
Please check for any on-going incidents in the incident issue tracker or in the#master-broken
Slack channel.1 Message This merge request adds or changes documentation files. A review from the Technical Writing team before you merge is recommended. Reviews can happen after you merge. Documentation review
The following files require a review from a technical writer:
-
doc/api/graphql/reference/index.md
(Link to current live version) -
doc/user/custom_roles/abilities.md
(Link to current live version)
The review does not need to block merging this merge request. See the:
-
Metadata for the
*.md
files that you've changed. The first few lines of each*.md
file identify the stage and group most closely associated with your docs change. - The Technical Writer assigned for that stage and group.
- Documentation workflows for information on when to assign a merge request for review.
Reviewer roulette
Category Reviewer Maintainer backend @adie.po
(UTC+0, 6 hours ahead of author)
@reprazent
(UTC+2, 8 hours ahead of author)
frontend @syarynovskyi
(UTC+3, 9 hours ahead of author)
@svedova
(UTC+2, 8 hours ahead of author)
groupauthorization Reviewer review is optional for groupauthorization @hmehra
(UTC+10, 16 hours ahead of author)
~"Verify" Reviewer review is optional for ~"Verify" @stanhu
(UTC-7, 1 hour behind author)
Please check reviewer's status!
Please refer to documentation page for guidance on how you can benefit from the Reviewer Roulette, or use the GitLab Review Workload Dashboard to find other available reviewers.
If needed, you can retry the
danger-review
job that generated this comment.Generated by
Danger-
added 1 commit
- c1df72d4 - Allow multiple ability checks against a single query
added 478 commits
-
c1df72d4...a0eed7c1 - 477 commits from branch
master
- 55fcb248 - Add admin_runner ability
-
c1df72d4...a0eed7c1 - 477 commits from branch
added 689 commits
-
f839d4a7...09c73788 - 688 commits from branch
master
- 47f0e34f - Add admin_runners ability
-
f839d4a7...09c73788 - 688 commits from branch
- Resolved by mo khan
added 254 commits
-
7936096c...a39366f6 - 252 commits from branch
master
- 0a9d0f50 - Add admin_runners ability
- a8ab292f - WIP
-
7936096c...a39366f6 - 252 commits from branch
added 1 commit
- 5f2a4586 - Enable admin_runners ability via custom role
added 1 commit
- c89cdf05 - Render CI/CD settings menu for admin_runners permission
added 1 commit
- 4083dbde - Extract context for rendering menu items for custom role permissions
added 1 commit
- f5875de4 - Use table tests to test lighting up menu items based on custom permission
added 2 commits
added 1 commit
- bec724c0 - Render Runner Settings if admin_runner enabled
- A deleted user
added frontend label
added 1 commit
- 0ecdc8d0 - Ensure Maintainers have the admin_runner ability
added 1 commit
- 6036304f - Check admin_runner permission in runners controller
added 1 commit
- ad995fe1 - Add spec to ensure GraphQL mutation works for custom roles
added 266 commits
-
78ed8029...0d8a2657 - 265 commits from branch
master
- c41d0711 - Add admin_runners ability
-
78ed8029...0d8a2657 - 265 commits from branch
mentioned in merge request !150415 (merged)
added 1 commit
- 1ace5303 - Add feature flag to gradually roll out this change
- A deleted user
added feature flag label
mentioned in merge request !151677 (merged)
mentioned in merge request !152654 (merged)
mentioned in merge request !152659 (merged)
- Resolved by mo khan
mentioned in issue #442851 (closed)
added 65 commits
-
9fbb126a...f5cd9b14 - 53 commits from branch
master
- f5cd9b14...99a62b3e - 2 earlier commits
- 5d4844a0 - Collapse admin_push_rules spec into table tests
- ddc56b29 - Generate traits for custom permissions
- 7f5a0e45 - Use #any? instead of #find
- d374a4fc - Use #any? instead of #find
- 69c8488c - Replace conditional with Hash
- 885fe305 - Add feature flag to gradually roll out this change
- 0077c5a5 - Use #filter_map instead of #tap + #each
- 309a2711 - Alias #build to #send
- a5bd09c7 - Add manage_deploy_tokens trait
- 6bee8141 - Add :manage_deploy_tokens to list of repository menu permissions
Toggle commit list-
9fbb126a...f5cd9b14 - 53 commits from branch
added 1 commit
- a0088061 - Use member roles preloader to check for custom permission
added 1 commit
- 286284a6 - Delegate to MemberRoleAbilityLoader to figure out the details
added 209 commits
-
286284a6...8ce6e5f7 - 207 commits from branch
master
- ba7ff4b4 - Add admin_runners ability
- f6bf90ef - Change milestone to 17.1
-
286284a6...8ce6e5f7 - 207 commits from branch
added 2 commits
added pipelinetier-1 label
added 1 commit
- 9b4294e9 - Add admin_runner to owner permissions in group policy
added 1 commit
- 572eed8f - Add spec for changing the shared runner setting on Group API
added 2 commits
added 1 commit
- 2f608414 - Authorize endpoint with one of many permissions
added 572 commits
-
2f608414...3ebd720a - 571 commits from branch
master
- a9824e6e - Add admin_runners ability
-
2f608414...3ebd720a - 571 commits from branch
- Resolved by mo khan
- Resolved by mo khan
added 231 commits
-
a9824e6e...e4ad9aff - 228 commits from branch
master
- 42457100 - Add admin_runners ability
- 265f8d48 - Remove extra permissions
- 08060a8f - Specify feature flag in admin_runners custom ability
Toggle commit list-
a9824e6e...e4ad9aff - 228 commits from branch
mentioned in merge request !153333 (merged)
added 225 commits
-
fc2ec315...a9e62412 - 224 commits from branch
master
- 91b35b74 - Add admin_runners ability
-
fc2ec315...a9e62412 - 224 commits from branch
added 303 commits
-
91b35b74...6776171b - 302 commits from branch
master
- 75459509 - Add admin_runners ability
-
91b35b74...6776171b - 302 commits from branch
mentioned in merge request !153742 (merged)
added 681 commits
-
75459509...0fc73b20 - 680 commits from branch
master
- 21bd6890 - Add admin_runners ability
-
75459509...0fc73b20 - 680 commits from branch
added 1 commit
- 6f6238b0 - Add admin_runner to list of allowed abilities
added 297 commits
-
f42acd10...b9bf2cc6 - 296 commits from branch
master
- aca4db00 - Add admin_runners ability
-
f42acd10...b9bf2cc6 - 296 commits from branch
added 1 commit
- 5b07ebd5 - Make spec pending to decouple from another MR
added 180 commits
- Resolved by Stan Hu
This change is still waiting on !153742 (merged) to be merged but I would like to start to get review feedback on this.
@alexbuijs do you mind giving this an initial backend review? @dftian do you mind giving this an initial frontend review?
requested review from @alexbuijs and @dftian
- Resolved by mo khan
- Resolved by mo khan
- Resolved by Savas Vedova
- Resolved by Jarka Košanová
removed review request for @alexbuijs
added pipeline:mr-approved label
- Resolved by mo khan
@alexbuijs
, thanks for approving this merge request.This is the first time the merge request has been approved. To ensure we don't only run predictive pipelines, and we don't break
master
, a new pipeline will be started shortly.Please wait for the pipeline to start before resolving this discussion and set auto-merge for the new pipeline. See merging a merge request for more details.
added pipelinetier-2 label and removed pipelinetier-1 label
E2E Test Result Summary
allure-report-publisher
generated test report!e2e-test-on-gdk:
test report for e204ceb1expand test summary
+------------------------------------------------------------------+ | suites summary | +-------------+--------+--------+---------+-------+-------+--------+ | | passed | failed | skipped | flaky | total | result | +-------------+--------+--------+---------+-------+-------+--------+ | Data Stores | 31 | 0 | 0 | 22 | 31 | ✅ | | Monitor | 8 | 0 | 0 | 7 | 8 | ✅ | | Govern | 128 | 0 | 2 | 82 | 130 | ✅ | | Package | 19 | 0 | 12 | 19 | 31 | ✅ | | Plan | 56 | 0 | 2 | 47 | 58 | ✅ | | Verify | 30 | 0 | 2 | 29 | 32 | ✅ | | Create | 129 | 0 | 10 | 93 | 139 | ✅ | | Release | 5 | 0 | 0 | 5 | 5 | ✅ | | Fulfillment | 1 | 0 | 0 | 0 | 1 | ✅ | | Manage | 0 | 0 | 1 | 0 | 1 | ➖ | | Analytics | 2 | 0 | 0 | 1 | 2 | ✅ | +-------------+--------+--------+---------+-------+-------+--------+ | Total | 409 | 0 | 29 | 305 | 438 | ✅ | +-------------+--------+--------+---------+-------+-------+--------+
e2e-package-and-test:
test report for e204ceb1expand test summary
+------------------------------------------------------------------+ | suites summary | +-------------+--------+--------+---------+-------+-------+--------+ | | passed | failed | skipped | flaky | total | result | +-------------+--------+--------+---------+-------+-------+--------+ | Govern | 182 | 0 | 16 | 0 | 198 | ✅ | | Plan | 44 | 0 | 4 | 0 | 48 | ✅ | | Create | 46 | 0 | 6 | 0 | 52 | ✅ | | Verify | 8 | 0 | 2 | 0 | 10 | ✅ | | Release | 2 | 0 | 0 | 0 | 2 | ✅ | | Data Stores | 22 | 0 | 0 | 0 | 22 | ✅ | | Package | 6 | 0 | 8 | 0 | 14 | ✅ | | Monitor | 8 | 0 | 0 | 0 | 8 | ✅ | +-------------+--------+--------+---------+-------+-------+--------+ | Total | 318 | 0 | 36 | 0 | 354 | ✅ | +-------------+--------+--------+---------+-------+-------+--------+
Generated bygitlab_quality-test_tooling
.
Slow tests detected in this merge request. These slow tests might be related to this merge request's changes.Click to expand
Job File Name Duration Expected duration #6958594181 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 69.08 s < 27.12 s #6958594268 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 78.28 s < 27.12 s #6958594684 spec/features/ide_spec.rb#L46
IDE with vscode feature flag off behaves like legacy Web IDE loads legacy Web IDE 63.92 s < 50.13 s #6960662361 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 74.81 s < 27.12 s #6960662411 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 82.46 s < 27.12 s #6974603645 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 70.53 s < 27.12 s #6974603574 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 69.46 s < 27.12 s #7005096129 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 63.76 s < 27.12 s #7005096029 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 67.81 s < 27.12 s #7008585325 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 70.3 s < 27.12 s #7008585284 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 75.37 s < 27.12 s #7017409647 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 64.49 s < 27.12 s #7017409724 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 78.7 s < 27.12 s #7018824587 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 72.82 s < 27.12 s #7018824455 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 75.51 s < 27.12 s #7020073350 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 65.44 s < 27.12 s #7020073495 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 77.41 s < 27.12 s #7033436949 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 63.26 s < 27.12 s #7033437005 spec/lib/release_highlights/validator_spec.rb#L82
ReleaseHighlights::Validator when validating all files they should have no errors 77.73 s < 27.12 s - A deleted user
added rspec:slow test detected label
removed review request for @dftian
added 579 commits
-
271efd78...fd5d26d1 - 577 commits from branch
master
- d63003a0 - Add admin_runners ability
- b52d5a8b - Apply 1 suggestion(s) to 1 file(s)
-
271efd78...fd5d26d1 - 577 commits from branch
reset approvals from @alexbuijs by pushing to the branch
added 1 commit
- 5a7f9577 - Allow admin_runner permission to update stale runner pruning setting
added 1 commit
- b76b6d5d - Add :admin_runner to UserNamespacePolicy next to :admin_namespace
- Resolved by mo khan
added 1 commit
- 532d966a - Remove unsafe authz change in groups REST API
mentioned in merge request !154848 (merged)
- Resolved by Savas Vedova
requested review from @stanhu
- Resolved by Stan Hu
removed review request for @stanhu
added 870 commits
-
532d966a...011b6569 - 869 commits from branch
master
- d89dc888 - Merge branch 'master' into 'mokhax/442851/admin_runners'
-
532d966a...011b6569 - 869 commits from branch
- Resolved by mo khan
I resolved the merge conflicts with !154601 (merged).
added 227 commits
-
d89dc888...ca3cb145 - 225 commits from branch
master
- dc5bcae4 - Add `admin_runners` custom ability
- dc5f9aa0 - Rename before action hook to be clearer
-
d89dc888...ca3cb145 - 225 commits from branch
reset approvals from @jarka by pushing to the branch
requested review from @stanhu
- Resolved by Jarka Košanová
removed review request for @stanhu
added 1 commit
- e204ceb1 - Revert authz changes to Mutation.namespaceCiCdSettingsUpdate
reset approvals from @stanhu by pushing to the branch
added pipelinetier-3 label and removed pipelinetier-2 label
enabled automatic add to merge train when the pipeline for 5722ade3 succeeds
mentioned in commit 2d5fb2ae
mentioned in issue #466033 (closed)
mentioned in incident gitlab-org/quality/engineering-productivity/master-broken-incidents#6733 (closed)
added workflowstaging-canary label
added workflowcanary label and removed workflowstaging-canary label
added workflowstaging label and removed workflowcanary label
added workflowproduction label and removed workflowstaging label
added releasedcandidate label
added releasedpublished label and removed releasedcandidate label
mentioned in merge request kubitus-project/kubitus-installer!3098 (merged)
mentioned in issue #330100