CI/CD Pipeline Security

• Who can trigger the pipeline?
• Who can change the gitlab-ci.yaml?

--> Every person with (write-)access to the repository. That's not good.

Solution

• Manage .gitlab-ci.yaml in separate repository
• Give only trusted people access to this repository
• Use this protected .gitlab-ci.yaml in hpc-compendium project via "Custom CI configuration path"

By implementing #14376 (closed), we make it so that the .gitlab-ci.yml can be pointed to in a different repo. In this way, the configuration can reference a file in another project with a completely different set of permissions. The file should be publicly accessible, but can be editable only by users in the other project. (https://gitlab.com/gitlab-org/gitlab/-/issues/15632)

Other reference: https://docs.gitlab.com/ee/ci/environments/deployment_safety.html#protect-gitlab-ciyml-from-change

https://gitlab.hrz.tu-chemnitz.de/help/ci/pipelines/settings#visibility-of-pipelines

changed the description

changed milestone to %Umstellung

changed the description

Separation of gitlab-ci.yaml from hpc-compendium is done.

closed