feat(ci): add UI for cross-project CI_JOB_TOKEN push setting
What does this MR do and why?
Adds the frontend for the cross-project CI_JOB_TOKEN push feature. Splits out the UI portion of !229671 (merged) so the backend GraphQL field (crossProjectPushForJobTokenAllowed) ships to GitLab.com before the frontend starts querying it.
This MR adds a second checkbox in Settings > CI/CD > Token access > Additional permissions: "Allow cross-project Git push requests from allowlisted projects".
Why a separate MR
Per review feedback on !229671 (merged)#note_3269395247, @gl_introduced only protects self-managed from version skew. On GitLab.com all nodes run the same version, so the directive does not strip unknown fields during rollout. If backend and frontend ship together, the frontend can hit backend pods whose schema does not yet know the new field, causing intermittent 400s until rollout completes. The mutation input argument crossProjectPushForJobTokenAllowed is also unprotected (input arguments cannot carry @gl_introduced), so splitting is the only correct fix.
Merge order
- Merge and deploy !229671 (merged) (backend) to GitLab.com.
- Wait for rollout to complete (all pods serving the new schema).
- Remove the
workflow::blockedlabel and merge this MR.
References
- Parent MR: !229671 (merged)
- Parent issue: #479907
- Review discussion: !229671 (merged)#note_3269395247
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.