<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/engineering/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=278964&issueIid=632647) </details> <!--IssueSummary end--> ### Release notes When editing an existing CI/CD variable, the **Masked and hidden** visibility option is now disabled in the UI, with a short explanation. Previously the option could be selected, but saving always failed with "Only new variables can be set as masked and hidden." The UI now reflects the rule enforced by the backend, so users no longer hit a predictable error. ### Problem to solve As a user managing CI/CD variables, I want the form to show me which visibility options are available for an existing variable, so I do not choose an option that the server will always reject. Currently, for a variable that already exists with visibility **Masked**, the **Masked and hidden** radio button is enabled in the edit form. Selecting it and saving returns: > Variables: Only new variables can be set as masked and hidden. Steps to reproduce: 1. Go to **Settings > CI/CD > Variables**. 2. Create a variable with visibility **Masked**. 3. Edit the variable and select **Masked and hidden**. 4. Click **Save changes**. The request fails with the error above. The restriction is part of the backend contract, but the UI does not declare it. Users learn about it only by trial and error, and each attempt is a request that is guaranteed to fail validation. ### Intended users * [Priyanka (Platform Engineer)](https://handbook.gitlab.com/handbook/product/personas/#priyanka-platform-engineer) * [Sasha (Software Developer)](https://handbook.gitlab.com/handbook/product/personas/#sasha-software-developer) * [Sidney (Systems Administrator)](https://handbook.gitlab.com/handbook/product/personas/#sidney-systems-administrator) Anyone with permission to edit CI/CD variables (Maintainer and above on projects, Owner on groups, administrators on the instance). ### User experience goal The user should be able to open the CI/CD variable edit form and see immediately which visibility options can be applied to the existing variable, without having to submit the form to find out. ### Proposal In the variable edit form (project, group, and instance level), when editing an **existing** variable: 1. Render the **Masked and hidden** option as disabled (greyed out, not selectable). 2. Add help text or a tooltip on the disabled option, for example: *"Only new variables can be set as masked and hidden."* 3. Keep the server-side validation and its error message unchanged. The UI is only a hint. The API remains the source of truth, and the error still covers requests sent directly to the API or with the control re-enabled through browser developer tools. The option stays enabled when creating a new variable. For a variable that is already **Masked and hidden**, the existing behavior is unchanged. User journey: 1. The user opens an existing **Masked** variable for editing. 2. The visibility options are shown, and **Masked and hidden** is greyed out with an explanation. 3. The user chooses between the remaining options, or creates a new variable if they need **Masked and hidden**. ### Further details Benefits for GitLab: * **Lower API load.** The UI stops generating requests that are guaranteed to fail validation. * **Explicit contract.** The "new variables only" rule is declared in the interface, so the UI and the API describe the same behavior. * **Fewer support questions.** The restriction is visible before the user acts, not after a failed save. ### Permissions and Security No permission changes. The same roles that can edit variables today can use the form. * [x] No access (0): no impact * [x] Guest (10): no impact * [x] Reporter (20): no impact * [x] Developer (30): no impact * [x] Maintainer (40): sees the disabled option when editing existing variables * [x] Owner (50): sees the disabled option when editing existing variables This is a UI-only change. Backend validation is deliberately kept as defense in depth, so re-enabling the control through developer tools or calling the API directly still results in the same validation error. No new attack surface is introduced. ### Documentation * Update the CI/CD variables documentation (visibility section) to state that **Masked and hidden** can only be set when a variable is created, and that an existing variable cannot be changed to this visibility. ### Availability & Testing Low availability risk, as this is a frontend-only change. * Unit test changes: the edit form renders the **Masked and hidden** option as disabled for an existing variable, and enabled for a new one. * Integration test changes: none expected. * End-to-end test changes: optionally, verify that the option is disabled on the edit form for an existing variable. ### Available Tier Free ### Feature Usage Metrics Compare the rate of validation failures with "Only new variables can be set as masked and hidden" before and after the change. It should drop to near zero for UI-originated requests. ### What does success look like, and how can we measure that? Success metric: the number of failed variable-update requests with this error, originating from the UI, drops to near zero. Acceptance criteria: * [ ] **Masked and hidden** is disabled when editing an existing variable, at project, group, and instance level. * [ ] The disabled state has an explanatory hint. * [ ] The option remains enabled when creating a new variable. * [ ] The backend validation and error message are unchanged. ### What is the type of buyer? Not applicable. This is a usability improvement for existing CI/CD variable users. ### Is this a cross-stage feature? No. It is limited to the CI/CD variables UI. ### What is the competitive advantage or differentiation for this feature? None specific. This is a usability and consistency improvement. ### Links / references * Error message: "Variables: Only new variables can be set as masked and hidden." * CI/CD variables documentation: https://docs.gitlab.com/ci/variables/