Skip to content

Correct job artifacts API download for expired and locked files

What does this MR do?

GitLab by default keeps artefacts beyond their expiration, if a pipeline is the latest one of a certain Ref. Such artefacts can then be downloaded, even if they would already be expired. This works so far in the Web UI, but if attempted via API (e.g. GET /api/v4/projects/:project/jobs/:job/artifacts/public%2Findex.html), this leads to a 404.

This was caused by the use of build.artifacts? instead of build.available_artifacts? within the API handler, which is not correct according to the inline code comment:

# available_artifacts?
# This method is similar to #artifacts? but it includes the artifacts
# locking mechanics. A new method was created to prevent breaking existing
# behavior and avoid introducing N+1s.

Screenshots (strongly suggested)

N.a.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

This MR aligns the check for artefact expiration with the one already used for the Web UI and also covers it with a test spec. Possible risks are therefore minimal.

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Fabio Huser

Merge request reports