Block spec:include in included configuration files

What does this MR do and why?

Block spec:include in included configuration files.

Similarly to how spec:include is blocked for components, this MR blocks its usage in files loaded via regular include: directives (local, project, and remote).

Using spec:include within included files results in unexpected context resolution behavior (e.g. local paths resolving against the wrong project/ref) and is not an intended use case. spec:include is specifically built for pipeline inputs at the root configuration level.

Implementation

Adds a validate_spec_include! method to External::File::Base that checks if an included file's YAML content contains a spec:include: header. If it does, the file is rejected with a clear error message before any further processing occurs.

References

Usage of spec:include: within regular includes ... (#590532) • Oleg Yakovenko • 19.5

Screenshots or screen recordings

NA

How to set up and validate locally

  1. Create three files in a project on your local GDK:

    .gitlab-ci.yml:

    include:
      - local: '/templates/job.yml'
        inputs:
          env: staging
    
    test:
      script: echo "hello"

    templates/job.yml:

    spec:
      include:
        - local: /templates/shared-inputs.yml
    ---
    deploy:
      script: echo "deploying to $[[ inputs.env ]]"

    templates/shared-inputs.yml:

    inputs:
      env:
        type: string
        default: production
  2. Go to Build > Pipeline editor and click Validate.

  3. Verify you see the error:

    Included file `templates/job.yml` cannot use `spec:include`.
    This keyword is not supported in included configuration files
  4. You should also see the same error in the Pipeline editor when the configuration is linted, as both the lint and pipeline creation flows go through the same config validation path.

  5. It should not affect pipelines started using trigger:include as they are the root config of the child pipeline.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Changelog: fixed

Related to #590532

Edited by Rajendra Kadam

Merge request reports

Loading
Loading