Add column to ci_builds_metadata to store secrets
What does this MR do?
This MR is part of series of dependent MRs extracted from !33231 (closed) in order to split work in smaller chunks:
-
(this MR) Add column to ci_builds_metadata to store secrets !34480 (merged)
- ci_secrets_management feature check !34587 (merged)
- Add check for "secrets" runner feature !34813 (merged)
- Yaml processing and saving secrets configuration in DB !34896 (merged)
- Expose secrets configuration in API response !34898 (merged)
- Yaml processing and saving secrets configuration in DB !34896 (merged)
- Add check for "secrets" runner feature !34813 (merged)
- ci_secrets_management feature check !34587 (merged)
It adds new column DB column ci_builds_metadata.secrets
that is of type jsonb
, there is also json schema validation for what data can be stored in it. It will be used to store the build secrets configured in yaml (see !33014 (merged)).
We'll use this column only to store secrets configuration and not gonna query it.
Related to #28321 (closed) and #218746 (closed).
Database Migration
$ bundle exec rails db:migrate:up VERSION=20200604001128
== 20200604001128 AddSecretsToCiBuildsMetadata: migrating =====================
-- add_column(:ci_builds_metadata, :secrets, :jsonb, {:default=>{}, :null=>false})
-> 0.0178s
== 20200604001128 AddSecretsToCiBuildsMetadata: migrated (0.0213s) ============
$ bundle exec db:migrate:down VERSION=20200604001128
== 20200604001128 AddSecretsToCiBuildsMetadata: reverting =====================
-- remove_column(:ci_builds_metadata, :secrets)
-> 0.0041s
== 20200604001128 AddSecretsToCiBuildsMetadata: reverted (0.0095s) ============
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec
-
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team
Edited by Krasimir Angelov