Restrict access to change .gitlab-ci.yml only for main branch and run pipeline only on main

GitLab CI/CD
1

Problem to solve

I have a pipeline that’s crucial for the business. It maintains user access to various systems. It consist with validation and apply stage. I want that:

  • it will run apply stage only on main and only with MR
  • users are able to create branches so that MR can be merged with a narrow group of people
  • users can’t change .gitlab-ci.yml on their branches, and modify rules so that their can grant permissions to run the apply stage
  • validation can be run on any branch

How I can achieve that with GitLab?

  • Self-managed
  • GitLab.com SaaS
  • Dedicated
  • Self-hosted Runners
  • GitLab SaaS Runners
2

If the .gitlab-ci.yml remains in the same project, users can edit it in their branches. A potential solution for that is to define pipeline execution policies, and always run specific jobs / limit access to the CI/CD configuration, living outside of the project.

The CI/CD configuration itself can then use rules to specify when it should be run (main branch, MRs, etc.). Such filtering could also be applied for jobs in the apply stage, and validation jobs that run all the time.

1 Like
3

Thank you