Skip flow triggers for cloud events caused by a flow

Igor Drozdovrequested to merge
630476-block-flow-originated-cloud-event-triggers into master

What does this MR do and why?

An AI flow can act through a composite identity, which is a service account acting for a human. These actions can publish cloud events, such as a work item status change. Flow triggers subscribed to those events then start another flow.

Flows should only start other flows once chaining is tracked and bounded. That work is planned in https://gitlab.com/gitlab-org/gitlab/-/work_items/630476. Until then, events caused by a flow do not start flow triggers.

  • Gitlab::EventStore::CloudEvent.build_cloud_event records a new optional envelope attribute, gitlab_composite_actor_id. It holds the service account's user ID. It is set when the request or Sidekiq job has a composite identity linked with the :authentication context. It is not set for :permission_check links, which are created when a human starts a flow. It is set no matter which user the event is attributed to.
  • Ai::CloudEventsFlowTriggerWorker skips flow triggers for events with this attribute. It logs reason: :non_human_trigger_not_permitted. This covers all seven cloud-event flow trigger workers.

The skip is on by default. Enabling the gitlab_com_derisk flag allow_flow_originated_cloud_event_triggers (actor: project) keeps the previous behavior for that project. The attribute is always recorded.

Known limitation: some events are published later by a job that does not carry the flow's identity, such as auto-merge. These events are not marked.

Changelog: changed, because the skip is on by default.

References

Screenshots or screen recordings

Not applicable, backend only.

How to set up and validate locally

  1. Create a flow trigger on a project for the work item event type.

  2. As a human, change a work item's status in the UI. The flow trigger starts a session.

  3. Change the status with a flow's composite identity token. For example, use the GraphQL workItemUpdate mutation from a running flow. No session starts, and the Sidekiq log shows Event caused by a flow, skipping flow triggers.

  4. Enable the flag for the project in a Rails console: Feature.enable(:allow_flow_originated_cloud_event_triggers, Project.find(<id>)). Repeat step 3. The flow trigger starts a session.

  5. Run the specs:

    bin/rspec ee/spec/requests/ai/flow_triggers/flow_originated_status_change_spec.rb ee/spec/workers/concerns/ai/cloud_events_flow_trigger_worker_spec.rb spec/lib/gitlab/event_store/cloud_event_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.

Edited by Igor Drozdov

Merge request reports