Skip to content

Add column to ci_builds_metadata to store secrets

Krasimir Angelov requested to merge ci-secrets-persistence into master

What does this MR do?

This MR is part of series of dependent MRs extracted from !33231 (closed) in order to split work in smaller chunks:

It adds new column DB column ci_builds_metadata.secrets that is of type jsonb, there is also json schema validation for what data can be stored in it. It will be used to store the build secrets configured in yaml (see !33014 (merged)).

We'll use this column only to store secrets configuration and not gonna query it.

Related to #28321 (closed) and #218746 (closed).

Database Migration

$ bundle exec rails db:migrate:up VERSION=20200604001128
== 20200604001128 AddSecretsToCiBuildsMetadata: migrating =====================
-- add_column(:ci_builds_metadata, :secrets, :jsonb, {:default=>{}, :null=>false})
   -> 0.0178s
== 20200604001128 AddSecretsToCiBuildsMetadata: migrated (0.0213s) ============

$ bundle exec db:migrate:down VERSION=20200604001128
== 20200604001128 AddSecretsToCiBuildsMetadata: reverting =====================
-- remove_column(:ci_builds_metadata, :secrets)
   -> 0.0041s
== 20200604001128 AddSecretsToCiBuildsMetadata: reverted (0.0095s) ============

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Krasimir Angelov

Merge request reports