You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The title of the PR states what changed and the related issues number (used for the release note).
Does this PR requires documentation updates?
I've updated documentation as required by this PR.
I have performed a self-review of my own code.
I have commented my code, particularly in hard-to-understand areas.
I have tested it for all user roles.
I have added all the required unit/api test cases.
Does this PR introduce a user-facing change?
Summary
OSS mirror of the enterprise dev-admin pipeline-lifecycle restriction. Introduces two Casbin actions createPipeline/deletePipeline and re-points only the CI/CD pipeline + workflow lifecycle handlers to them, so a dev-admin custom role can no longer create or delete pipelines/workflows — while it still edits config and triggers CI/CD.
admin/manager/super-admin unaffected: they hold applications:*, and MatchKeyByPart treats * as matching any action — no migration/backfill.
Migration 36904600 whitelists the new actions for custom-role composition.
Covers CD_CREATE-via-PatchCdPipeline and the bulk CD-delete endpoint. PatchCiPipelines uses an OSS-appropriate action branch (OSS lacks the enterprise linked-CD/switch-CI refactor).
Test Plan
dev-admin token → 403: create/delete CI pipeline, create/delete CD pipeline (incl. partial & bulk delete), create/delete workflow
dev-admin token → 200: edit deployment template / ConfigMap / Secret / env overrides, update CI branch/source, non-delete CD patch, trigger CI & CD
Regression → 200: admin/manager/super-admin create/delete CI, CD, workflow; jobs manager create/delete jobs
Bito didn't auto-review because the source or target branch is excluded from automatic reviews. To trigger review, type /review in the comment and save. You can change the settings here, or contact the agent instance creator at [email protected].
Avoids collision with develop's 36704600_variable_entity_mapping_index; aligns with enterprise 36904600.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
develop added 36904600_add_ci_workflow_active_status_index (packet 46); move ours to
the next free slot in the current packet (48).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Explicit custom-role grants cannot match these action values. AddPolicy lowercases stored actions (Adapter.go:166), but enforcement passes request actions unchanged and MatchKeyByPart compares them case-sensitively. A createPipeline grant becomes createpipeline, so the corresponding request is denied; the same applies to deletion. Wildcard policies mask the mismatch. Use lowercase constant values so requests match the normalized policies.
…sbin store
Casbin normalizes policy actions to lowercase on store (AddPolicy -> strings.ToLower) while enforcement passes the action unchanged. The mixed-case createApp/deleteApp/createPipeline/deletePipeline constants therefore never matched an explicit custom-role grant. Lowercase the constant values and the whitelist labels; the Release-1 createApp/deleteApp labels are normalized inside this PR's 37004800 migration via array_replace so the already-shipped 36504600 migration is left untouched.
admin (*) and dev-admin (omission) are unaffected; this only fixes future explicit custom-role grants of these four actions.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
…bove develop max
develop added migrations up to 37504600; the runner only applies versions above the current schema version, so a 37004800 migration would be skipped on envs already at 37504600. Bumped to 37704800 (packet 48) to stay above develop's max and keep both repos aligned.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Se9N8bnyDEitxXB69Pt55V
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes https://github.com/devtron-labs/sprint-tasks/issues/2976
Checklist:
Does this PR introduce a user-facing change?
Summary
OSS mirror of the enterprise
dev-adminpipeline-lifecycle restriction. Introduces two Casbin actionscreatePipeline/deletePipelineand re-points only the CI/CD pipeline + workflow lifecycle handlers to them, so adev-admincustom role can no longer create or delete pipelines/workflows — while it still edits config and triggers CI/CD.applications:*, andMatchKeyByParttreats*as matching any action — no migration/backfill.jobsresource only.36904600whitelists the new actions for custom-role composition.CD_CREATE-via-PatchCdPipelineand the bulk CD-delete endpoint.PatchCiPipelinesuses an OSS-appropriate action branch (OSS lacks the enterprise linked-CD/switch-CI refactor).Test Plan
🤖 Generated with Claude Code