Skip to content

Draft: feat: Support Merged Result Pipelines, Merge Request Pipelines, and allow commit_list to be provided directly to Secret-Detection.gitlab-ci.yml

Lucas Charles requested to merge theoretick-master-patch-92466 into master

What does this MR do and why?

Three changes to Category:Secret Detection template

  • Supports Merged Results Pipelines which are extra funky since they don't rely on a true commit (see below)
  • Specify commit range for Merge Request Pipelines which rely on CI_MERGE_REQUEST_DIFF_BASE_SHA
  • Updates the Category:Secret Detection template to allow manually specifying commit_list.txt file. In certain cases it's too difficult to determine programmatically, so this allows individuals to provide one explicitly in before_scripts or elsewhere.

Quoting from the docs regarding "Merged Result Pipelines":

GitLab creates an internal commit with the merged results, so the pipeline can run against it. This commit does not exist in either branch, but you can view it in the pipeline details.

So instead we just rely on the latest $CI_COMMIT_SHA in those cases too

See testing with gitlab-com/www-gitlab-com!100862 (closed)

I don't think these are all necessary in one go but touch on several different areas so using this MR as a playground

Note: these may not all seem necessary in one go but each is required for www-gitlab-com is a culmination of each of the previously unsupported cases.

How to set up and validate locally

include:
  remote: https://gitlab.com/gitlab-org/gitlab/-/raw/theoretick-master-patch-92466/lib/gitlab/ci/templates/Jobs/Secret-Detection.gitlab-ci.yml

job:
  before_script: echo ${CI_COMMIT_SHA} >${CI_COMMIT_SHA}_commit_list.txt

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Lucas Charles

Merge request reports