Skip to content

Add support for Compliance Pipeline configuration location

Aishwarya Subramanian requested to merge compliance_pipeline_configuration into master

What does this MR do?

This MR has database and backend changes to support Compliance Pipeline configuration location.

Database changes:

Adds pipeline_configuration_full_path to the compliance_management_frameworks table.

Purpose of the new column:

The column will be used to store the location of the compliance pipeline configuration file. The file will be automatically loaded for projects that use the label defined for the framework (none of this is implemented in the scope of this MR - for contextual purpose only).

Backend changes:

Ability to use the pipeline_configuration_full_path attribute in the Create, Update and List graphql api for Compliance Frameworks.

Create API example

Query:

  mutation {
    createComplianceFramework(input: {namespacePath: "acting-group", params: {name: "compliance test", description: "this is a test framework", color: "#FFFFFF", pipelineConfigurationFullPath: "compliance/.gitlab-ci.yml"}}) {
      framework {
        id
        name
        color
        description
        pipelineConfigurationFullPath
      }
      errors
    }
  }

Response:

  {
    "data": {
      "createComplianceFramework": {
        "framework": {
          "id": "gid://gitlab/ComplianceManagement::Framework/5",
          "name": "compliance test",
          "color": "#FFFFFF",
          "description": "this is a test framework",
          "pipelineConfigurationFullPath": "compliance/.gitlab-ci.yml"
         },
         "errors": []
       }
     }
   }
Update API example

Query:

  mutation {
    updateComplianceFramework(input: {id: "gid://gitlab/ComplianceManagement::Framework/5"
      params: {
        pipelineConfigurationFullPath: "soc2/.gitlab-ci.yml"
      }
    })
    {
      complianceFramework {
        id
        name
        color
        pipelineConfigurationFullPath
      }
    }
  }

Response:

  {
    "data": {
      "updateComplianceFramework": {
        "complianceFramework": {
          "id": "gid://gitlab/ComplianceManagement::Framework/5",
          "name": "compliance test",
          "color": "#FFFFFF",
          "pipelineConfigurationFullPath": "soc2/.gitlab-ci.yml"
        }
      }
    }
  }
List API example

Query:

  query {
    namespace(fullPath: "acting-group") {
      id
      name
      complianceFrameworks {         
        nodes {
          id
          name
          description
          color
          pipelineConfigurationFullPath
        }
      }
    }
  }

Response:

  {
    "data": {
      "namespace": {
        "id": "gid://gitlab/Group/364",
        "name": "acting-group",
        "complianceFrameworks": {
          "nodes": [
            {
              "id": "gid://gitlab/ComplianceManagement::Framework/5",
              "name": "compliance test",
              "description": "this is a test framework",
              "color": "#FFFFFF",
              "pipelineConfigurationFullPath": "soc2/.gitlab-ci.yml"
            }
          ]
        }
      }
    }
  }

Feature Flag

There is an existing FF for the Compliance framework APIs: ff_custom_compliance_frameworks (rollout issue) The attribute will be available when this FF is enabled.

Mentions #254389 (closed)

Migration output

Add column 
== 20210113224909 AddPipelineConfigurationFullPathToCompliancePipeline: migrating
-- add_column(:compliance_management_frameworks, :pipeline_configuration_full_path, :text)
   -> 0.0018s
== 20210113224909 AddPipelineConfigurationFullPathToCompliancePipeline: migrated (0.0018s)
Add text limit 
== 20210119162812 AddTextLimitToCompliancePipelineConfigurationFullPath: migrating
-- transaction_open?()
   -> 0.0000s
-- current_schema()
   -> 0.0004s
-- execute("ALTER TABLE compliance_management_frameworks\nADD CONSTRAINT check_e7a9972435\nCHECK ( char_length(pipeline_configuration_full_path) <= 255 )\nNOT VALID;\n")
   -> 0.0008s
-- current_schema()
   -> 0.0002s
-- execute("SET statement_timeout TO 0")
   -> 0.0002s
-- execute("ALTER TABLE compliance_management_frameworks VALIDATE CONSTRAINT check_e7a9972435;")
   -> 0.0006s
-- execute("RESET ALL")
   -> 0.0002s
== 20210119162812 AddTextLimitToCompliancePipelineConfigurationFullPath: migrated (0.0107s)

Rollback

Remove column 
== 20210113224909 AddPipelineConfigurationFullPathToCompliancePipeline: reverting
-- remove_column(:compliance_management_frameworks, :pipeline_configuration_full_path)
   -> 0.0102s
== 20210113224909 AddPipelineConfigurationFullPathToCompliancePipeline: reverted (0.0102s)
Remove text limit 
== 20210119162812 AddTextLimitToCompliancePipelineConfigurationFullPath: reverting
-- execute("ALTER TABLE compliance_management_frameworks\nDROP CONSTRAINT IF EXISTS check_e7a9972435\n")
   -> 0.0012s
== 20210119162812 AddTextLimitToCompliancePipelineConfigurationFullPath: reverted (0.0073s)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Aishwarya Subramanian

Merge request reports