diff mbox series

[v2] gitlab: only let pages be published from default branch

Message ID 20210723113051.2792799-1-berrange@redhat.com (mailing list archive)
State New, archived
Headers show
Series [v2] gitlab: only let pages be published from default branch | expand

Commit Message

Daniel P. Berrangé July 23, 2021, 11:30 a.m. UTC
GitLab will happily publish pages generated by the latest CI pipeline
from any branch:

https://docs.gitlab.com/ee/user/project/pages/introduction.html

  "Remember that GitLab Pages are by default branch/tag agnostic
   and their deployment relies solely on what you specify in
   .gitlab-ci.yml. You can limit the pages job with the only
   parameter, whenever a new commit is pushed to a branch used
   specifically for your pages."

The current "pages" job is not limited, so it is happily publishing
docs content from any branch/tag in qemu.git that gets pushed to.
This means we're potentially publishing from the "staging" branch
or worse from outdated "stable-NNN" branches

This change restricts it to only publish from the default branch
in the main repository. For contributor forks, however, we allow
it to publish from any branch, since users will have arbitrarily
named topic branches in flight at any time.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 .gitlab-ci.d/buildtest.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

Comments

Philippe Mathieu-Daudé July 23, 2021, 12:41 p.m. UTC | #1
On 7/23/21 1:30 PM, Daniel P. Berrangé wrote:
> GitLab will happily publish pages generated by the latest CI pipeline
> from any branch:
> 
> https://docs.gitlab.com/ee/user/project/pages/introduction.html
> 
>   "Remember that GitLab Pages are by default branch/tag agnostic
>    and their deployment relies solely on what you specify in
>    .gitlab-ci.yml. You can limit the pages job with the only
>    parameter, whenever a new commit is pushed to a branch used
>    specifically for your pages."
> 
> The current "pages" job is not limited, so it is happily publishing
> docs content from any branch/tag in qemu.git that gets pushed to.
> This means we're potentially publishing from the "staging" branch
> or worse from outdated "stable-NNN" branches
> 
> This change restricts it to only publish from the default branch
> in the main repository. For contributor forks, however, we allow
> it to publish from any branch, since users will have arbitrarily
> named topic branches in flight at any time.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  .gitlab-ci.d/buildtest.yml | 18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)
> 
> diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
> index 89df51517c..80b57b7082 100644
> --- a/.gitlab-ci.d/buildtest.yml
> +++ b/.gitlab-ci.d/buildtest.yml
> @@ -663,6 +663,17 @@ build-tools-and-docs-debian:
>  
>  # Prepare for GitLab pages deployment. Anything copied into the
>  # "public" directory will be deployed to $USER.gitlab.io/$PROJECT
> +#
> +# GitLab publishes from any branch that triggers a CI pipeline
> +#
> +# For the main repo we don't want to publish from 'staging'
> +# since that content may not be pushed, nor do we wish to
> +# publish from 'stable-NNN' branches as that content is outdated.
> +# Thus we restrict to just the default branch
> +#
> +# For contributor forks we want to publish from any repo so
> +# that users can see the results of their commits, regardless
> +# of what topic branch they're currently using
>  pages:
>    image: $CI_REGISTRY_IMAGE/qemu/debian-amd64:latest
>    stage: test
> @@ -681,3 +692,10 @@ pages:
>    artifacts:
>      paths:
>        - public
> +  rules:
> +    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
> +      when: on_success
> +    - if: '$CI_PROJECT_NAMESPACE == "qemu-project"'
> +      when: never
> +    - if: '$CI_PROJECT_NAMESPACE != "qemu-project"'
> +      when: on_success
> 

This is the same than:

  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH ==
$CI_DEFAULT_BRANCH'
  - if: '$CI_PROJECT_NAMESPACE != "qemu-project"'
  - when: never

But in your case defaults are explicit, so better.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Daniel P. Berrangé July 23, 2021, 12:45 p.m. UTC | #2
On Fri, Jul 23, 2021 at 02:41:47PM +0200, Philippe Mathieu-Daudé wrote:
> On 7/23/21 1:30 PM, Daniel P. Berrangé wrote:
> > GitLab will happily publish pages generated by the latest CI pipeline
> > from any branch:
> > 
> > https://docs.gitlab.com/ee/user/project/pages/introduction.html
> > 
> >   "Remember that GitLab Pages are by default branch/tag agnostic
> >    and their deployment relies solely on what you specify in
> >    .gitlab-ci.yml. You can limit the pages job with the only
> >    parameter, whenever a new commit is pushed to a branch used
> >    specifically for your pages."
> > 
> > The current "pages" job is not limited, so it is happily publishing
> > docs content from any branch/tag in qemu.git that gets pushed to.
> > This means we're potentially publishing from the "staging" branch
> > or worse from outdated "stable-NNN" branches
> > 
> > This change restricts it to only publish from the default branch
> > in the main repository. For contributor forks, however, we allow
> > it to publish from any branch, since users will have arbitrarily
> > named topic branches in flight at any time.
> > 
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> > ---
> >  .gitlab-ci.d/buildtest.yml | 18 ++++++++++++++++++
> >  1 file changed, 18 insertions(+)
> > 
> > diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
> > index 89df51517c..80b57b7082 100644
> > --- a/.gitlab-ci.d/buildtest.yml
> > +++ b/.gitlab-ci.d/buildtest.yml
> > @@ -663,6 +663,17 @@ build-tools-and-docs-debian:
> >  
> >  # Prepare for GitLab pages deployment. Anything copied into the
> >  # "public" directory will be deployed to $USER.gitlab.io/$PROJECT
> > +#
> > +# GitLab publishes from any branch that triggers a CI pipeline
> > +#
> > +# For the main repo we don't want to publish from 'staging'
> > +# since that content may not be pushed, nor do we wish to
> > +# publish from 'stable-NNN' branches as that content is outdated.
> > +# Thus we restrict to just the default branch
> > +#
> > +# For contributor forks we want to publish from any repo so
> > +# that users can see the results of their commits, regardless
> > +# of what topic branch they're currently using
> >  pages:
> >    image: $CI_REGISTRY_IMAGE/qemu/debian-amd64:latest
> >    stage: test
> > @@ -681,3 +692,10 @@ pages:
> >    artifacts:
> >      paths:
> >        - public
> > +  rules:
> > +    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
> > +      when: on_success
> > +    - if: '$CI_PROJECT_NAMESPACE == "qemu-project"'
> > +      when: never
> > +    - if: '$CI_PROJECT_NAMESPACE != "qemu-project"'
> > +      when: on_success
> > 
> 
> This is the same than:
> 
>   rules:
>   - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH ==
> $CI_DEFAULT_BRANCH'
>   - if: '$CI_PROJECT_NAMESPACE != "qemu-project"'
>   - when: never
> 
> But in your case defaults are explicit, so better.

yeah, i find it confusing when the 'when:' clause is left out


Regards,
Daniel
Thomas Huth July 27, 2021, 6:30 a.m. UTC | #3
On 23/07/2021 13.30, Daniel P. Berrangé wrote:
> GitLab will happily publish pages generated by the latest CI pipeline
> from any branch:
> 
> https://docs.gitlab.com/ee/user/project/pages/introduction.html
> 
>    "Remember that GitLab Pages are by default branch/tag agnostic
>     and their deployment relies solely on what you specify in
>     .gitlab-ci.yml. You can limit the pages job with the only
>     parameter, whenever a new commit is pushed to a branch used
>     specifically for your pages."
> 
> The current "pages" job is not limited, so it is happily publishing
> docs content from any branch/tag in qemu.git that gets pushed to.
> This means we're potentially publishing from the "staging" branch
> or worse from outdated "stable-NNN" branches
> 
> This change restricts it to only publish from the default branch
> in the main repository. For contributor forks, however, we allow
> it to publish from any branch, since users will have arbitrarily
> named topic branches in flight at any time.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   .gitlab-ci.d/buildtest.yml | 18 ++++++++++++++++++
>   1 file changed, 18 insertions(+)
> 
> diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
> index 89df51517c..80b57b7082 100644
> --- a/.gitlab-ci.d/buildtest.yml
> +++ b/.gitlab-ci.d/buildtest.yml
> @@ -663,6 +663,17 @@ build-tools-and-docs-debian:
>   
>   # Prepare for GitLab pages deployment. Anything copied into the
>   # "public" directory will be deployed to $USER.gitlab.io/$PROJECT
> +#
> +# GitLab publishes from any branch that triggers a CI pipeline
> +#
> +# For the main repo we don't want to publish from 'staging'
> +# since that content may not be pushed, nor do we wish to
> +# publish from 'stable-NNN' branches as that content is outdated.
> +# Thus we restrict to just the default branch
> +#
> +# For contributor forks we want to publish from any repo so
> +# that users can see the results of their commits, regardless
> +# of what topic branch they're currently using
>   pages:
>     image: $CI_REGISTRY_IMAGE/qemu/debian-amd64:latest
>     stage: test
> @@ -681,3 +692,10 @@ pages:
>     artifacts:
>       paths:
>         - public
> +  rules:
> +    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
> +      when: on_success
> +    - if: '$CI_PROJECT_NAMESPACE == "qemu-project"'
> +      when: never
> +    - if: '$CI_PROJECT_NAMESPACE != "qemu-project"'
> +      when: on_success
> 


Reviewed-by: Thomas Huth <thuth@redhat.com>
Willian Rampazzo July 27, 2021, 2:42 p.m. UTC | #4
On Fri, Jul 23, 2021 at 8:31 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> GitLab will happily publish pages generated by the latest CI pipeline
> from any branch:
>
> https://docs.gitlab.com/ee/user/project/pages/introduction.html
>
>   "Remember that GitLab Pages are by default branch/tag agnostic
>    and their deployment relies solely on what you specify in
>    .gitlab-ci.yml. You can limit the pages job with the only
>    parameter, whenever a new commit is pushed to a branch used
>    specifically for your pages."
>
> The current "pages" job is not limited, so it is happily publishing
> docs content from any branch/tag in qemu.git that gets pushed to.
> This means we're potentially publishing from the "staging" branch
> or worse from outdated "stable-NNN" branches
>
> This change restricts it to only publish from the default branch
> in the main repository. For contributor forks, however, we allow
> it to publish from any branch, since users will have arbitrarily
> named topic branches in flight at any time.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  .gitlab-ci.d/buildtest.yml | 18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)
>

Reviewed-by: Willian Rampazzo <willianr@redhat.com>
diff mbox series

Patch

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 89df51517c..80b57b7082 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -663,6 +663,17 @@  build-tools-and-docs-debian:
 
 # Prepare for GitLab pages deployment. Anything copied into the
 # "public" directory will be deployed to $USER.gitlab.io/$PROJECT
+#
+# GitLab publishes from any branch that triggers a CI pipeline
+#
+# For the main repo we don't want to publish from 'staging'
+# since that content may not be pushed, nor do we wish to
+# publish from 'stable-NNN' branches as that content is outdated.
+# Thus we restrict to just the default branch
+#
+# For contributor forks we want to publish from any repo so
+# that users can see the results of their commits, regardless
+# of what topic branch they're currently using
 pages:
   image: $CI_REGISTRY_IMAGE/qemu/debian-amd64:latest
   stage: test
@@ -681,3 +692,10 @@  pages:
   artifacts:
     paths:
       - public
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+      when: on_success
+    - if: '$CI_PROJECT_NAMESPACE == "qemu-project"'
+      when: never
+    - if: '$CI_PROJECT_NAMESPACE != "qemu-project"'
+      when: on_success