Skip to content

Disallow manual triggers of populate_dep_cache #11829

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gh-worker-dd-mergequeue-cf854d merged 4 commits into from
Jul 1, 2026
+0 −2
Merged

Disallow manual triggers of populate_dep_cache #11829

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
14eca47
Scope dependency caches to protected refs
sarahchen6 Jul 1, 2026
e6c4a40
Revert "Scope dependency caches to protected refs"
sarahchen6 Jul 1, 2026
3d3de3a
Dont allow manual triggers for populate_dep_cache
sarahchen6 Jul 1, 2026
714e60b
Merge branch 'master' into sarahchen6/protect-caches
sarahchen6 Jul 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions .gitlab-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -388,8 +388,6 @@ populate_dep_cache:
rules:
- if: '$POPULATE_CACHE'
when: on_success
Comment on lines 389 to 390

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Restrict cache-populating pipelines to trusted refs

With the manual fallback removed, this remaining rule still allows any manually-created pipeline that supplies a non-empty POPULATE_CACHE variable to run the cache-pushing matrix; GitLab documents that bare variable rules match when the variable is defined/non-empty and that manual pipelines can include CI/CD variables (https://docs.gitlab.com/ci/jobs/job_rules/#ci/cd-variable-expressions, https://docs.gitlab.com/ci/pipelines/#run-a-pipeline-manually). In that scenario an untrusted branch can still push the shared dependency-* caches (DEPENDENCY_CACHE_POLICY: push with unprotect: true), so the intended protection against corrupted PR caches is bypassed unless this rule is also constrained to a trusted source/ref such as the scheduled/default-branch path.

Useful? React with 👍 / 👎.

- when: manual
allow_failure: true
parallel:
matrix:
- GRADLE_TARGET: ":dd-java-agent:shadowJar :dd-trace-api:jar :dd-trace-ot:shadowJar"
Expand Down