Repository Mirroring Between Repo1 and code.ilx - Limitations

This article summarizes repository mirroring between repo1 and code.ilx.dso.mil and the associated limitations.

Gotchas

• Mirror setup between repo1 → code.il2.dso.mil
  • Push mirror:
    • Does not bypass push rules for commits done on the web UI (e.g. merge commits). Requires approval from Cyber for a commit signing exception on the project/app.
    • Updates mirror within 5 minutes of a push to the source repo.
    • A project access token cannot be used if the Custom CI Path is using another repo. Permission denied error when trying to trigger a pipeline and a project access token bot cannot be added to other projects.
      • Deploy keys can span multiple repos within a group but uses SSH which cannot be used for mirroring between repo1 and code.ilx.
  • A new gitlab user has to be created to set up the mirror. Note, even though you can setup multiple mirrors with one user across different apps, it's advised not to. It is best practice to limit the scope of tokens as much as possible.
    • If multiple repos under the app need to be mirrored, the new user should have access to the app's gitlab group (organization → team → app → projects). This way the user can be reused for other repos that need to be mirrored.
    • If only one repo, the new user should only have access to the project that needs to be mirrored.
    • Grant Developer if you do not want to mirror protected branches or if developers are allowed to push to protected branches. Otherwise, use Maintainer.
    • This user will be named as the pipeline triggerer.
  • Pull mirror:
    • Bypasses push rules for merge commits.
    • The mirror polls the source for updates every 30 minutes.
    • A repo1 project access token with the Reporter role and the read-repository scope is sufficient to set up the mirror.
    • Only gitlab admins are allowed to setup mirrors.
    • If the mirror is set up to trigger pipelines it will use the gitlab admin's account as the pipeline triggerer.

If you need to setup a mirror between repo1 and code.ilx.dso.mil, please create a ticket.