## Release Notes The ability to limit projects that can use a CI_JOB_TOKEN to authenticate within your project is a big improvement to securing a project's CI/CD Pipelines but this feature has to be enabled leaving new projects at risk. Starting with GitLab 15.9 the inbound scope limit for the CI_JOB_TOKEN will be enabled by default for new projects. ## Problem Before we make [job token scope always enabled](https://gitlab.com/gitlab-org/gitlab/-/issues/335465) in the next major release we need to start transitioning into this default behavior. ## Plan To rollout the Job Token Scope feature we decided to follow this plan: Under a single feature flag: 1. [deploy the setting for inbound](https://gitlab.com/gitlab-org/gitlab/-/issues/375782) 1. set default to true - allow people to turn the group level setting off - **this issue** <details><summary>Click to expand</summary> This work will be carried out in two steps 1. Set default to true on application level for new projects. This will be under a feature flag. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/109689 2. Set default to true on database level. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/110196 </details> Not under the same flag (no this issue): 1. [remove the setting toggle completely, so that it's always on](https://gitlab.com/gitlab-org/gitlab/-/issues/335465) ## Solution * Enable the inbound job token scope (in project's settings) by default for new projects prior to the major release. * Enabling this setting by default would mean that QA tests on staging environment will have the setting enabled too. We need to change those E2E tests to ensure that the inbound job token scope is configured (target projects added to the scope) and not disabled. Pre-requisites: - documentation must be clear on why a CI_JOB_TOKEN can't access a repository and how to troubleshoot - customer need to know in advance that we are planning to enable it by default for new projects - customer should be able to opt-out <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION --> *This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.* <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION -->