Skip to content

feat(job_token_scope): support Groups in job token allowlist API #2816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
May 13, 2024

Conversation

TimKnight-DWP
Copy link
Contributor

Builds ontop of: #2767 and #2790

Closes #2762

Adds support for adding Group to job_token_allowlist: https://docs.gitlab.com/ee/api/project_job_token_scopes.html#add-a-group-to-a-cicd-job-token-allowlist

@TimKnight-DWP
Copy link
Contributor Author

NOTE: Group allowlist functionality is due in 16.10 eta: March 21st

I will develop tests using the nightly builds image, and leave in draft until 16.10 is released

@TimKnight-DWP TimKnight-DWP force-pushed the feat/group-allowlist branch from 11ac87a to e3576be Compare March 4, 2024 12:25
@TimKnight-DWP TimKnight-DWP force-pushed the feat/group-allowlist branch 2 times, most recently from 5f27abe to 5aa3701 Compare March 5, 2024 16:01
@TimKnight-DWP TimKnight-DWP marked this pull request as ready for review March 5, 2024 16:06
@TimKnight-DWP
Copy link
Contributor Author

Ready for Review
Marked ready to review, tests are passing against the nightly build which includes the Group allowlist changes

For merge in will need to mark as XFail or have a feature flag based on if 16.10+ is active or no?

Copy link

codecov bot commented Mar 5, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.50%. Comparing base (7ec3189) to head (ee826ad).
Report is 48 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2816      +/-   ##
==========================================
- Coverage   96.52%   96.50%   -0.03%     
==========================================
  Files          90       90              
  Lines        5872     5889      +17     
==========================================
+ Hits         5668     5683      +15     
- Misses        204      206       +2     
Flag Coverage Δ
api_func_v4 82.37% <70.37%> (+0.13%) ⬆️
cli_func_v4 83.59% <70.37%> (+0.01%) ⬆️
unit 88.30% <100.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Coverage Δ
gitlab/v4/objects/job_token_scope.py 100.00% <100.00%> (ø)

... and 1 file with indirect coverage changes

@TimKnight-DWP TimKnight-DWP force-pushed the feat/group-allowlist branch from 9d5b099 to 9386847 Compare March 6, 2024 13:06
@TimKnight-DWP TimKnight-DWP force-pushed the feat/group-allowlist branch 2 times, most recently from a815a6f to d2cc51e Compare March 28, 2024 10:41
@TimKnight-DWP TimKnight-DWP force-pushed the feat/group-allowlist branch 3 times, most recently from 8771e7d to 8f12f86 Compare April 29, 2024 13:49
@TimKnight-DWP
Copy link
Contributor Author

@nejch built on the work you started and some of the discussions we had a few months back, this adds support for managing the CI Job Token via python-gitlab.

@TimKnight-DWP TimKnight-DWP force-pushed the feat/group-allowlist branch from 0481c52 to 2bbe2ba Compare May 7, 2024 09:42
@TimKnight-DWP
Copy link
Contributor Author

Hi @nejch , @JohnVillalovos , @max-wittig , @bufferoverflow

Myself and @SachinKSingh28 among others will be working on a project to migrate from Gitlab-SAAS to Dedicate, alongside our work on GitLabForm project we will be adding in Enterprise feature sets to python-gitlab.

Would there be a good way to discuss a ways of working that is useful for the demands on your time, and if it would be helpful for us to also take on Maintainership of the project? As it's a key part of our infrastructure here at the DWP (a UK Gov public sector department)

@JohnVillalovos
Copy link
Member

Would there be a good way to discuss a ways of working that is useful for the demands on your time, and if it would be helpful for us to also take on Maintainership of the project? As it's a key part of our infrastructure here at the DWP (a UK Gov public sector department)

Nothing personal but after what happened to XZ project [1]. Having people asking to become maintainers is looked warily by me.

https://news.ycombinator.com/item?id=39865810

But I would be up for a video-conference if @nejch would like to do it. Doing a hackathon or something along those lines could be fun.

@JohnVillalovos
Copy link
Member

Overall this is looking pretty good to me. My suggestions are mostly minor.

@TimKnight-DWP
Copy link
Contributor Author

TimKnight-DWP commented May 8, 2024

Would there be a good way to discuss a ways of working that is useful for the demands on your time, and if it would be helpful for us to also take on Maintainership of the project? As it's a key part of our infrastructure here at the DWP (a UK Gov public sector department)

Nothing personal but after what happened to XZ project [1]. Having people asking to become maintainers is looked warily by me.

https://news.ycombinator.com/item?id=39865810

But I would be up for a video-conference if @nejch would like to do it. Doing a hackathon or something along those lines could be fun.

@JohnVillalovos -> Oh absolutely! We work in Security here, and having seen what happen with XZ is why I've not wanted to be too pushy 👍

We would be up for having a video-conference call etc. We're on BST

@TimKnight-DWP TimKnight-DWP force-pushed the feat/group-allowlist branch from 2bbe2ba to 4f5cfed Compare May 8, 2024 08:22
@TimKnight-DWP
Copy link
Contributor Author

Updated PR

Copy link
Member

@JohnVillalovos JohnVillalovos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is looking good to me. Left a couple of comments about trying to get the code coverage test to pass.

Hopefully @nejch can do a review on this too.

@TimKnight-DWP
Copy link
Contributor Author

@JohnVillalovos updated once more, I certainly intended to have already covered those paths, but clearly hadn't so done now 👍

@JohnVillalovos JohnVillalovos force-pushed the feat/group-allowlist branch from e1d5f8d to ee826ad Compare May 13, 2024 21:03
Signed-off-by: Tim Knight <tim.knight1@engineering.digital.dwp.gov.uk>
Signed-off-by: Tim Knight <tim.knight1@engineering.digital.dwp.gov.uk>
Signed-off-by: Tim Knight <tim.knight1@engineering.digital.dwp.gov.uk>
Signed-off-by: Tim Knight <tim.knight1@engineering.digital.dwp.gov.uk>
Signed-off-by: Tim Knight <tim.knight1@engineering.digital.dwp.gov.uk>
Signed-off-by: Tim Knight <tim.knight1@engineering.digital.dwp.gov.uk>
Signed-off-by: Tim Knight <tim.knight1@engineering.digital.dwp.gov.uk>
@JohnVillalovos JohnVillalovos force-pushed the feat/group-allowlist branch from ee826ad to 4aab77f Compare May 13, 2024 21:25
@JohnVillalovos JohnVillalovos enabled auto-merge (squash) May 13, 2024 21:28
@JohnVillalovos JohnVillalovos merged commit 2d1b749 into python-gitlab:main May 13, 2024
16 checks passed
@TimKnight-DWP TimKnight-DWP deleted the feat/group-allowlist branch May 14, 2024 07:06
@TimKnight-DWP
Copy link
Contributor Author

Thanks for the merge @JohnVillalovos

If you wanted to have a chat, we can talk through what we're doing with GitLab on our end and how that'll interface with python-gitlab.

Hopefully this calendly link should work: https://calendly.com/tim-knight1/30min

@JohnVillalovos
Copy link
Member

Thanks for the merge @JohnVillalovos

If you wanted to have a chat, we can talk through what we're doing with GitLab on our end and how that'll interface with python-gitlab.

Hopefully this calendly link should work: https://calendly.com/tim-knight1/30min

Meeting sounds great to me, but I would like to wait for @nejch to join. I'm assuming that he is on vacation or something as I haven't heard from him for a bit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support /projects/:id/job_token_scope/allowlist
4 participants