>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3361106. --> Reported by: [hestenet](https://www.drupal.org/user/54034) Related to !168 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>In DrupalCI today, we trigger testing when a user uploads a patch, opens an MR, or hits the manual add-test button.</p> <p>In GitLabCI, we have configured a template with the following workflow rules to trigger testing: </p> <pre>workflow:<br>&nbsp; rules:<br>&nbsp; # These 3 rules from https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Workflows/MergeRequest-Pipelines.gitlab-ci.yml<br>&nbsp;&nbsp;&nbsp; # Run on merge requests<br>&nbsp;&nbsp;&nbsp; - if: $CI_MERGE_REQUEST_IID<br>&nbsp;&nbsp;&nbsp; - if: $CI_PIPELINE_SOURCE == 'merge_request_event'<br>&nbsp;&nbsp;&nbsp; # Run on tags<br>&nbsp;&nbsp;&nbsp; - if: $CI_COMMIT_TAG<br>&nbsp;&nbsp;&nbsp; # Run when called from an upstream pipeline https://docs.gitlab.com/ee/ci/pipelines/downstream_pipelines.html?tab=Multi-project+pipeline#use-rules-to-control-downstream-pipeline-jobs<br>&nbsp;&nbsp;&nbsp; - if: $CI_PIPELINE_SOURCE == 'pipeline'<br>&nbsp;&nbsp;&nbsp; - if: $CI_PIPELINE_SOURCE == 'parent-child'<br>&nbsp;&nbsp;&nbsp; # Run on commits to the default branch<br>&nbsp;&nbsp;&nbsp; - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH<br>&nbsp;&nbsp;&nbsp; # The last rule above blocks manual and scheduled pipelines on non-default branch. The rule below allows them:<br>&nbsp;&nbsp;&nbsp; - if: $CI_PIPELINE_SOURCE == "schedule"<br>&nbsp;&nbsp;&nbsp; # Run if triggered from Web using 'Run Pipelines'<br>&nbsp;&nbsp;&nbsp; - if: $CI_PIPELINE_SOURCE == "web"<br>&nbsp;&nbsp;&nbsp;&nbsp; # Run if triggered from WebIDE<br>&nbsp;&nbsp;&nbsp; - if: $CI_PIPELINE_SOURCE == "webide"&nbsp;&nbsp; </pre><p>However, GitLab CI places limits on automated pipeline runs based on the permissions of the user running the pipeline: </p> <p><a href="https://git.drupalcode.org/help/ci/pipelines/merge_request_pipelines.md#run-pipelines-in-the-parent-project">https://git.drupalcode.org/help/ci/pipelines/merge_request_pipelines.md#run-pipelines-in-the-parent-project</a></p> <p>Specifically: </p> <blockquote><p> <strong>Project members in the parent project </strong>can trigger a merge request pipeline for a merge request submitted from a fork project. This pipeline:</p> <ul> <li>Is created and runs in the parent (target) project, not the fork (source) project.</li> <li>Uses the CI/CD configuration present in the fork project's branch.</li> <li>Uses the parent project's CI/CD settings, resources, and project CI/CD variables.</li> <li><strong>Uses the permissions of the parent project member that triggers the pipeline.</strong></li> </ul> </blockquote> <p>Because our collaboration model has collaborators working on a fork <strong>without</strong> granting them any permissions on the parent project, it means that despite the workflow trigger for running on an open MR - the pipeline will not run if the user opening the MR isn't a project member with sufficient permissions. </p> <p>The only ways for an MR opened by a non-member to run is:</p> <ul> <li>To run the pipeline in the fork itself, where the non-member of the parent project <strong>does</strong> have permissions</li> <li>For a project member to 'run pipeline' on the merge request manually. </li> <li>(maybe)For a bot user added as a project member to run the pipeline based on a webhook event.</li> </ul> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <p>To show that the current configuration is using the merge request trigger correctly:</p> <ul> <li>As a <strong>project member</strong>: <ul> <li>open a fork</li> <li>make changes</li> <li>and submit an MR back to the project </li> </ul> </li> </ul> <p>The pipelines should run in the parent correctly </p> <p>To show that the current configuration does not allow non-members to trigger pipelines</p> <ul> <li>As a <strong>non-member of the project</strong>: <ul> <li>open a fork</li> <li>make changes</li> <li>and submit an MR back to the project </li> </ul> </li> </ul> <p>Note that the MR is open but pipelines have <strong>not</strong> run. </p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Pending some more testing to validate the problem, the options will be:</p> <ul> <li>Enable testing on project forks</li> <li>Use the drupal-bot user on each project to trigger the pipelines on MRs based on a webhook: <a href="https://docs.gitlab.com/ee/user/project/integrations/webhook_events.html#merge-request-events">https://docs.gitlab.com/ee/user/project/integrations/webhook_events.html#merge-request-events</a></li> </ul> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Run the test scenarios</li> <li>Check additional keyword options including triggers, and the 'downstream' and 'upstream' workflow rules, in case they can work around this. </li> <li>Evaluate security tradeoffs of either resolution </li><li>Decide on one of the proposed resolutions</li> <li>Implement</li> </ul> > Related issue: [Issue #3265092](https://www.drupal.org/node/3265092) > Related issue: [Issue #3261803](https://www.drupal.org/node/3261803)