Load every CommitStatus type for Orbit ci_build redaction

Michael Angelo Riverarequested to merge
michaelangeloio/orbit-redaction-commit-status into master

What does this MR do and why?

Orbit sends the ids of its CI Job rows to Rails with the type ci_build. Rails loads them with Ci::Build, which finds only build rows. Bridge (trigger) jobs and external commit statuses are never found, so Orbit always hides them.

This MR loads ci_build ids with CommitStatus. All three job classes load, and each one uses its own policy. Bridges and external statuses delegate read_build to the project, the same gate as the pipeline jobs list.

References

Screenshots or screen recordings

Orbit query MATCH (j:Job) WHERE j.id IN [...] RETURN j for 10 jobs in one project, as a Reporter:

Before After
6 rows: builds only 10 rows: 6 builds, 3 bridges, 1 external status

How to set up and validate locally

  1. Use a project with Orbit on.
  2. Push a .gitlab-ci.yml with one script job and one trigger: include: job.
  3. Add an external status: POST /projects/:id/statuses/:sha with name=external-check.
  4. Run the query above with POST /api/v4/orbit/query. Before this MR, the bridge and the status are missing. After it, they are present.
  5. Run bin/rspec ee/spec/services/ee/authz/redaction_service_spec.rb. The new with ci_builds allow example fails without the fix.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports