Validate remote mirror url uniqueness and self-reference
What does this MR do and why?
Contributes to #603810 (closed)
Problem
The RemoteMirror model did not prevent a project from adding
multiple push mirrors with the same URL, nor from pointing a mirror
at the project's own repository. Both were silently accepted, leading
to redundant sync jobs and self-mirroring loops.
Solution
- Add a create-only
url_not_duplicatedvalidation that rejects a second mirror with the same sanitized URL on the same project. - Add a create-only
url_not_pointing_to_selfvalidation that rejects a mirror targeting the project's own HTTP or SSH repository URL. - Compare on the sanitized stored URL so credentials neither leak into errors nor make detection credential-sensitive.
- Scope both to
on: :createso existing duplicate or self-mirrors are grandfathered and ongoing syncs, toggles, and edits keep working.
References
- Issue: #603810 (closed)
- MR that surfaced this: !240866 (merged)
- Discussion thread: !240866 (comment 3482834754)
Screenshots or screen recordings
| Before | After |
|---|---|
![]() |
![]() |
How to set up and validate locally
- Go to a project's Settings > Repository > Mirroring repositories.
- Add a push mirror with some URL, then try adding a second mirror with the same URL — it is now rejected.
- Try adding a mirror pointing at the project's own repository URL — it is now rejected.
- Run the specs:
bin/rspec spec/models/remote_mirror_spec.rb.
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Edited by Vasilii Iakliushin

