Draft: Prototype: Duo Code Review depth settings for admin, group and project [skip ci]

Tars Cunharequested to merge
gitlab-community/gitlab-org/gitlab:prototype/duo-code-review-allow-deep-reviews into master

⚠️ UX prototype — not intended to merge. Backend plumbing is real and works in GDK with a Duo Enterprise license.

What

Adds "Allow deep reviews" and "Depth level" cascading settings for GitLab Duo Code Review at admin, group, and project level. Everything is behind the duo_code_review_deep_flow feature flag. With the flag off, every page renders as it does on master.

Epic: gitlab-org&23598 — [Beta] Duo Code Review: Review Context and Depth

Screenshots

Before = duo_code_review_deep_flow off (the page as on master). After = flag on, default settings. Each image shows the GitLab Duo Code Review section of the page. To see the behavior (live disabling of Deep), check out the branch and follow How to test.

Page Before After
Admin — Settings > General > GitLab Duo Code Review admin-general-before admin-general-after
Group — Settings > General > Merge requests group-mr-before group-mr-after
Project — Settings > Merge requests project-mr-before project-mr-after

How to test

Prerequisites: GDK at http://gdk.test:3000 with a Duo Enterprise seat assigned.

Set up:

git fetch origin prototype/duo-code-review-allow-deep-reviews
git checkout prototype/duo-code-review-allow-deep-reviews
bin/rails db:migrate
gdk restart
# Rails console
Feature.enable(:duo_code_review_deep_flow)

1. Flag off matches master: run Feature.disable(:duo_code_review_deep_flow) and reload the three pages in the Screenshots table. None of them show the new controls. Enable the flag again before continuing.

2. Deep disabled live: on any of the three pages, select Deep, then uncheck Allow deep reviews without saving. The Deep radio disables immediately, and the selection switches to Standard. Re-check it and Deep enables again. Reload to discard.

Roll back migration:

mise exec ruby@3.4.10 -- bin/rails db:migrate:down VERSION=20261016182129
Details

Settings added

Setting Column Type Levels
Allow deep reviews duo_code_review_depth_allowed Cascading boolean (default: on) Admin, Group, Project
Depth level (Standard / Deep) duo_code_review_default_depth Cascading smallint enum: 0 = Standard (default), 1 = Deep Admin, Group, Project

The columns, types, defaults, and nullability match the database MR !263955 (merged). The migration also adds its lock_* columns, but the UI doesn't use them: there are no Enforce checkboxes.

Where the settings appear

Level Page GDK URL
Admin Settings > General > GitLab Duo Code Review /admin/application_settings/general
Group Settings > General > Merge requests > GitLab Duo Code Review /groups/gitlab-duo/-/edit
Project Settings > Merge requests > GitLab Duo Code Review /gitlab-duo/test/-/settings/merge_requests

Key decisions

  • Admin controls in Settings > General only: Not on GitLab Duo > Configuration (review).
  • No Enforce checkboxes: Uses the cascading settings framework and shared/namespaces/cascading_settings partials for the two settings, without lock checkboxes. "Allow deep reviews" alone controls whether Deep can be chosen as the default depth (review).
  • Deep disabled live: Unchecking "Allow deep reviews" disables the Deep radio immediately, without a save. If Deep was selected, the selection switches to Standard. Implemented in initDeepReviewControls, following the initReviewOnPushCheckbox pattern.
  • Changes replace the values below: The settings follow the cascade-on-write pattern from !263955 (merged), like duo_auto_mode_enabled. Saving a value at the instance or a group writes it to every group and project below, replacing their own values. The help text says so instead of promising that overrides persist.
  • Language: Aligned with !252129 (closed): "Depth level", "Standard (Default)", "Efficient review, limited context.", "Extensive analysis, more context."

Open questions

  1. Placement for group and project. The group and project controls sit in the Code Review sections, next to the existing automatic review setting. The alternative is next to GitLab Duo availability, which exists at group level only on GitLab.com (GitLab Duo > Configuration). On self-managed it lives in Settings > General > GitLab Duo features.
  2. Label. The column is duo_code_review_depth_allowed so it still fits if a third depth is added. The label still says "Allow deep reviews". Should it become depth-neutral, for example "Allow deeper reviews"?
  3. Warning before a cascade. Because saving at a parent replaces the values below, should the page warn before it saves, for example with a confirmation modal?

Not implemented (prototype scope)

Item What production needs
No tests RSpec and frontend specs for model, controller, HAML, and initDeepReviewControls
No API/GraphQL REST and GraphQL support for all three levels
No CascadeDuoSettingsService registration Add to DUO_SETTINGS so admin changes propagate asynchronously

🤖 Generated with Claude Code

Edited by Tars Cunha

Merge request reports