Re: [PATCH v2] gitlab: only let pages be published from default branch

[Philippe Mathieu-Daudé]

On 7/23/21 1:30 PM, Daniel P. Berrangé wrote:
> GitLab will happily publish pages generated by the latest CI pipeline
> from any branch:
> 
> https://docs.gitlab.com/ee/user/project/pages/introduction.html
> 
>   "Remember that GitLab Pages are by default branch/tag agnostic
>    and their deployment relies solely on what you specify in
>    .gitlab-ci.yml. You can limit the pages job with the only
>    parameter, whenever a new commit is pushed to a branch used
>    specifically for your pages."
> 
> The current "pages" job is not limited, so it is happily publishing
> docs content from any branch/tag in qemu.git that gets pushed to.
> This means we're potentially publishing from the "staging" branch
> or worse from outdated "stable-NNN" branches
> 
> This change restricts it to only publish from the default branch
> in the main repository. For contributor forks, however, we allow
> it to publish from any branch, since users will have arbitrarily
> named topic branches in flight at any time.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  .gitlab-ci.d/buildtest.yml | 18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)
> 
> diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
> index 89df51517c..80b57b7082 100644
> --- a/.gitlab-ci.d/buildtest.yml
> +++ b/.gitlab-ci.d/buildtest.yml
> @@ -663,6 +663,17 @@ build-tools-and-docs-debian:
>  
>  # Prepare for GitLab pages deployment. Anything copied into the
>  # "public" directory will be deployed to $USER.gitlab.io/$PROJECT
> +#
> +# GitLab publishes from any branch that triggers a CI pipeline
> +#
> +# For the main repo we don't want to publish from 'staging'
> +# since that content may not be pushed, nor do we wish to
> +# publish from 'stable-NNN' branches as that content is outdated.
> +# Thus we restrict to just the default branch
> +#
> +# For contributor forks we want to publish from any repo so
> +# that users can see the results of their commits, regardless
> +# of what topic branch they're currently using
>  pages:
>    image: $CI_REGISTRY_IMAGE/qemu/debian-amd64:latest
>    stage: test
> @@ -681,3 +692,10 @@ pages:
>    artifacts:
>      paths:
>        - public
> +  rules:
> +    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH == 
> $CI_DEFAULT_BRANCH'
> +      when: on_success
> +    - if: '$CI_PROJECT_NAMESPACE == "qemu-project"'
> +      when: never
> +    - if: '$CI_PROJECT_NAMESPACE != "qemu-project"'
> +      when: on_success
> 

This is the same than:

  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH ==
$CI_DEFAULT_BRANCH'
  - if: '$CI_PROJECT_NAMESPACE != "qemu-project"'
  - when: never

But in your case defaults are explicit, so better.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>