Add artifact registry repository create, update, and delete mutations

Narendranrequested to merge
narendran/ar-s07-repository-crud-mutations into master

What does this MR do and why?

This MR adds three GraphQL mutations for Artifact Registry repositories:

  • ArtifactRegistryRepositoryCreate
  • ArtifactRegistryRepositoryUpdate
  • ArtifactRegistryRepositoryDelete

They build on the already-merged Mutations::ArtifactRegistry::Base template class. Each concrete mutation only implements resolve_artifact_registry and returns its payload fields. Base handles the feature-flag gate, the read_artifact_registry membership floor, org resolution from context, and error rendering.

Behavior per mutation:

  • Create: accepts name (required), format (required), kind, visibility, and description. It forwards any kind to Artifact Registry. Phase 1 serves hosted. Other kinds pass through and Artifact Registry rejects them if unsupported.
  • Update: name is identity only and cannot be changed. format is not exposed. Name and format are immutable per ADR-009 and ADR-022. Only visibility and description are writable. Omitted fields are left untouched.
  • Delete: takes name only. It is idempotent. Artifact Registry answers a missing repository with success.

Each mutation declares its own authorize_granular_token skip_reason: :external_service_authorizes, because Artifact Registry performs the per-operation authorization and these root mutations own no group or project to scope a token against. The repository payload field uses skip_type_authorization because Artifact Registry already authorized the write before returning the row.

This MR consolidates what were three separate stacked MRs (!248979 (closed) create, !248981 (closed) update, !248983 (closed) delete) into one, now that the foundation MR !248967 (merged) has merged to master. The reviewer requested the consolidation to cut review back-and-forth.

All fields and arguments are experiment: { milestone: '19.3' } behind the dark feature flag artifact_registry_ui. There is no user-facing change and no changelog.

Frontend and multiversion compatibility

This MR removes the three @client mutation extensions from the Vue app's local Apollo typedefs (graphql/typedefs.graphql), because the schema now defines these mutations and keeping the local extensions would collide during the Apollo schema build.

The .mutation.graphql operation files and their mock resolvers are unchanged and still run on @client. The switch of the frontend from the local mocks to the real server mutations lands in a separate follow-up MR. This keeps the backend schema change and the frontend switchover in separate deploys, per GraphQL multiversion-compatibility guidance.

Generated files doc/api/graphql/reference/_index.md and public/-/graphql/introspection_result.json are regenerated.

Testing: request specs for all three mutations live under ee/spec/requests/api/graphql/mutations/artifact_registry/repositories/. 18 examples pass. They cover flag-off, non-member, Artifact Registry authorization denial, and happy paths.

References

How to set up and validate locally

Enable the flag on an organization and run one createRepository mutation:

org = Organizations::Organization.first
Feature.enable(:artifact_registry_ui, org)

user = User.first

query = <<~GRAPHQL
  mutation {
    artifactRegistryRepositoryCreate(input: { name: "my-repo", format: DOCKER }) {
      repository { name }
      errors
    }
  }
GRAPHQL

result = GitlabSchema.execute(
  query,
  context: { current_user: user, current_organization: org }
)

result.to_h

Verified in local:

ar-crud-integration-test

MR acceptance checklist

This MR meets the MR acceptance checklist.

Edited by Narendran

Merge request reports