gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

gitlab: 18.11.7 -> 19.0.4 (#535595)

Browse Source
This commit is contained in:
yaya
2026-07-30 11:06:26 +00:00
committed by GitHub
parent 7e4787465e 82500abba9
commit 907474235e
19 changed files with 1229 additions and 752 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/doc/manual/redirects.json
+3
View File
@@ -1451,6 +1451,9 @@
"module-services-gitlab-maintenance-rake": [
"index.html#module-services-gitlab-maintenance-rake"
],
"module-services-gitlab-registry-database-migration": [
"index.html#module-services-gitlab-registry-database-migration"
],
"module-services-gitlab-runner": [
"index.html#module-services-gitlab-runner"
],
nixos/doc/manual/release-notes/rl-2611.section.md
+4
View File
@@ -121,6 +121,8 @@
- String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.
- `services.gitlab.registry` has been modified so that the GitLab container registry runs in the `gitlab-container-registry` system user. This behavior can be modified with the `services.gitlab.registry.user` option.
- `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
- `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.
@@ -184,6 +186,8 @@
This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible's unauthenticated "first launch" setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS's default binding to `localhost` without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet).
This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.
- `services.gitlab.registry` now uses PostgreSQL as database storage for new installations and supports old installations that use the filesystem as metadata storage. It creates the required PostgreSQL database and user. Users can manually migrate their filesystem based metadata storage. See [GitLab Container Registry Migration to database metadata store](#module-services-gitlab-registry-database-migration).
- The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
- The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
nixos/modules/module-list.nix
+2 -1
View File
@@ -885,7 +885,8 @@
./services/misc/gammu-smsd.nix
./services/misc/geoipupdate.nix
./services/misc/gitea.nix
./services/misc/gitlab.nix
./services/misc/gitlab/container-registry.nix
./services/misc/gitlab/default.nix
./services/misc/gitolite.nix
./services/misc/gitweb.nix
./services/misc/gollum.nix
nixos/modules/services/misc/gitlab/container-registry.nix
+387
View File
@@ -0,0 +1,387 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.gitlab.registry;
jsonFmt = pkgs.formats.json { };
enableDatabase = cfg.settings.database.enabled == true || cfg.settings.database.enabled == "prefer";
# We only want to create a database if we're actually going to connect to it.
databaseActuallyCreateLocally = cfg.databaseCreateLocally && cfg.settings.database.host == "";
enableDatabaseLocally = enableDatabase && cfg.settings.database.host == "";
configFile = jsonFmt.generate "gitlab-container-registry-config.json" cfg.settings;
in
{
imports = [
(lib.mkRenamedOptionModule
[ "services" "gitlab" "registry" "issuer" ]
[
"services"
"gitlab"
"registry"
"settings"
"auth"
"token"
"issuer"
]
)
(lib.mkRenamedOptionModule
[ "services" "gitlab" "registry" "serviceName" ]
[
"services"
"gitlab"
"registry"
"settings"
"auth"
"token"
"service"
]
)
(lib.mkRemovedOptionModule [
"services"
"gitlab"
"registry"
"port"
] "Use services.gitlab.registry.settings.http.addr instead.")
];
options.services.gitlab.registry = {
enable = lib.mkEnableOption "GitLab container registry";
package = lib.mkPackageOption pkgs "gitlab-container-registry" {
extraDescription = ''
External container registries such as `pkgs.distribution` are not supported
anymore since GitLab 16.0.0.
'';
};
host = lib.mkOption {
type = lib.types.str;
default = config.services.gitlab.host;
defaultText = lib.literalExpression "config.services.gitlab.host";
description = "Address of the GitLab instance, Gitlab Contianer Registry connects to.";
};
certFile = lib.mkOption {
type = lib.types.path;
description = "Path to GitLab container registry certificate.";
};
keyFile = lib.mkOption {
type = lib.types.path;
description = "Path to GitLab container registry certificate key.";
};
defaultForProjects = lib.mkOption {
type = lib.types.bool;
default = cfg.enable;
defaultText = lib.literalExpression "config.services.gitlab.registry.enable";
description = "If GitLab container registry should be enabled by default for projects.";
};
user = lib.mkOption {
type = lib.types.str;
default = "gitlab-container-registry";
description = "User the registry runs as";
};
externalAddress = lib.mkOption {
type = lib.types.str;
default = "";
description = "External address used to access registry from the internet";
};
externalPort = lib.mkOption {
type = lib.types.port;
description = "External port used to access registry from the internet";
};
databaseCreateLocally = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Whether a database should be automatically created on the
local host. Set this to `false` if you plan
to provision a local database yourself. This has no effect
if {option}`services.gitlab.registry.settings.database.host` is customized.
'';
};
storagePath = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default =
if lib.versionAtLeast config.system.stateVersion "27.05" then
"/var/lib/gitlab-container-registry"
else
"/var/lib/docker-registry";
defaultText = lib.literalExpression ''
if lib.versionAtLeast config.system.stateVersion "27.05" then
"/var/lib/gitlab-container-registry"
else
"/var/lib/docker-registry"
'';
description = ''
GitLab container registry storage path for the filesystem storage backend. Set to
null to configure another backend via settings.
'';
};
enableDelete = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable delete for manifests and blobs.";
};
enableRedisCache = lib.mkEnableOption "redis as blob cache";
redisUrl = lib.mkOption {
type = lib.types.str;
default = "localhost:6379";
description = "Set redis host and port.";
};
redisPassword = lib.mkOption {
type = lib.types.str;
default = "";
description = "Set redis password.";
};
settings = lib.mkOption {
description = ''
GitLab container registry configuration.
'';
default = { };
type = lib.types.submodule {
freeformType = jsonFmt.type;
options = {
version = lib.mkOption {
type = lib.types.str;
default = "0.1";
description = "Version of the configuration file";
};
auth.token = {
realm = lib.mkOption {
type = lib.types.str;
description = "The realm in which the registry server authenticates.";
default = "http${
lib.optionalString (config.services.gitlab.https == true) "s"
}://${cfg.host}/jwt/auth";
defaultText = lib.literalExpression ''
"http''${
lib.optionalString (config.services.gitlab.https == true) "s"
}://''${cfg.host}/jwt/auth"
'';
};
service = lib.mkOption {
type = lib.types.str;
description = "The service being authenticated";
default = "container_registry";
};
issuer = lib.mkOption {
type = lib.types.str;
description = "The name of the token issuer. The issuer inserts this into the token so it must match the value configured for the issuer.";
default = "gitlab-issuer";
};
rootcertbundle = lib.mkOption {
type = lib.types.path;
default = cfg.certFile;
defaultText = lib.literalExpression "config.services.gitlab.registry.certFile";
readOnly = true;
description = "The absolute path to the root certificate bundle. This bundle contains the public part of the certificates used to sign authentication tokens.";
};
};
database = {
enabled = lib.mkOption {
type = lib.types.oneOf [
lib.types.bool
(lib.types.enum [ "prefer" ])
];
default = "prefer";
description = ''
Whether to enable the database metadata store.
"prefer" is a mode that uses the database as metadata store, but falls back to the filesystem store when it has not been imported yet into the database.
'';
};
dbname = lib.mkOption {
type = lib.types.str;
default = "gitlab-container-registry";
description = "The database name that is used.";
};
host = lib.mkOption {
type = lib.types.str;
default = "";
description = "The database host GitLab container registry connects to. An empty string means 'use local unix socket connection'";
};
};
health.storagedriver = {
enabled = lib.mkEnableOption "storage driver health checks" // {
default = true;
};
threshold = lib.mkOption {
type = lib.types.ints.unsigned;
default = 3;
description = "The number of times the check must fail before the state is marked as unhealthy";
};
};
http = {
addr = lib.mkOption {
type = lib.types.str;
default = "127.0.0.1:4567";
description = "Address the contianer registry listens on.";
};
headers.X-Content-Type-Options = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "nosniff" ];
description = "Value the X-Content-Type-Options HTTP header should be set to. 'nosniff' is recommended by GitLab.";
};
};
log.fields.service = lib.mkOption {
type = lib.types.str;
default = "gitlab-container-registry";
description = "The service name added to log messages";
};
storage.cache.blobdescriptor = lib.mkOption {
type = lib.types.str;
default = if cfg.enableRedisCache then "redis" else "inmemory";
defaultText = lib.literalExpression "if config.services.gitlab.registry.enableRedisCache then \"redis\" else \"inmemory\"";
description = "Backend to use for caching.";
};
};
};
};
garbageCollection = {
enable = lib.mkEnableOption "garbage collection";
dates = lib.mkOption {
default = "daily";
type = lib.types.str;
description = ''
Specification (in the format described by
{manpage}`systemd.time(7)`) of the time at
which the garbage collection will occur.
'';
};
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.databaseCreateLocally -> databaseActuallyCreateLocally;
message = "'services.gitlab.registry.databaseCreateLocally' has no effect when services.gitlab.registry.database.host is customized. Please set 'services.gitlab.registry.databaseCreateLocally' to 'false' and setup the database manually or remove your custom value for 'services.gitlab.registry.database.host'";
}
];
environment.etc."gitlab-container-registry-config.json".source = configFile;
services.gitlab.registry.settings = {
# This must be true, otherwise GitLab won't manage it correctly
delete.enabled = true;
# GitLab container registry enables the redis cache as soon as the redis key exists in the config file.
redis = lib.mkIf cfg.enableRedisCache (
{
addr = "${cfg.redisUrl}";
password = "${cfg.redisPassword}";
}
// (builtins.mapAttrs (_: lib.mkDefault) {
db = 0;
dialtimeout = "10ms";
readtimeout = "10ms";
writetimeout = "10ms";
pool = {
maxidle = 16;
maxactive = 64;
idletimeout = "300s";
};
})
);
storage.filesystem.rootdirectory = lib.mkIf (cfg.storagePath != null) cfg.storagePath;
};
systemd.services.gitlab-registry-cert = {
path = with pkgs; [ openssl ];
script =
let
user = config.services.gitlab.user;
group = config.services.gitlab.group;
in
''
mkdir -p $(dirname ${cfg.keyFile}) $(dirname ${cfg.certFile})
openssl req -nodes -newkey rsa:4096 -keyout ${cfg.keyFile} -out /tmp/registry-auth.csr -subj "/CN=${cfg.settings.auth.token.issuer}"
openssl x509 -in /tmp/registry-auth.csr -out ${cfg.certFile} -req -signkey ${cfg.keyFile} -days 3650
chown ${user}:${group} $(dirname ${cfg.keyFile}) $(dirname ${cfg.certFile}) ${cfg.keyFile} ${cfg.certFile}
'';
unitConfig = {
ConditionPathExists = "!${cfg.certFile}";
};
serviceConfig = {
Type = "oneshot";
Slice = "system-gitlab.slice";
};
};
systemd.services.gitlab-container-registry = {
description = "GitLab Container Registry";
wantedBy = [ "multi-user.target" ];
# Ensure Docker Registry launches after the certificate generation job
wants = [ "gitlab-registry-cert.service" ];
after = [
"network.target"
"gitlab-registry-cert.service"
]
++ lib.optionals enableDatabaseLocally [ "postgresql.target" ];
requires = lib.optionals enableDatabaseLocally [ "postgresql.target" ];
preStart = lib.mkIf enableDatabaseLocally "${lib.getExe cfg.package} database migrate up --skip-post-deployment ${configFile}";
postStart = lib.mkIf enableDatabaseLocally "${lib.getExe cfg.package} database migrate up ${configFile}";
serviceConfig = {
ExecStart = "${lib.getExe cfg.package} serve ${configFile}";
User = cfg.user;
WorkingDirectory = cfg.storagePath;
AmbientCapabilities = "cap_net_bind_service";
};
};
# This is only required for legacy metadata, database metadata backend does online garbage collection
systemd.services.gitlab-container-registry-garbage-collect = {
description = "Run Garbage Collection for GitLab container registry";
restartIfChanged = false;
unitConfig.X-StopOnRemoval = false;
serviceConfig.Type = "oneshot";
script = ''
${lib.getExe cfg.package} garbage-collect ${configFile}
/run/current-system/systemd/bin/systemctl restart gitlab-container-registry.service
'';
startAt = lib.optional cfg.garbageCollection.enable cfg.garbageCollection.dates;
};
services.postgresql = lib.mkIf databaseActuallyCreateLocally {
ensureDatabases = [ "gitlab-container-registry" ];
ensureUsers = [
{
name = "gitlab-container-registry";
ensureDBOwnership = true;
}
];
};
users.users.gitlab-container-registry = lib.mkIf (cfg.user == "gitlab-container-registry") (
(lib.optionalAttrs (cfg.storagePath != null) {
createHome = true;
home = cfg.storagePath;
})
// {
group = "gitlab-container-registry";
isSystemUser = true;
}
);
users.groups.gitlab-container-registry = lib.mkIf (cfg.user == "gitlab-container-registry") { };
};
}
nixos/modules/services/misc/gitlab.md → nixos/modules/services/misc/gitlab/default.md
+14
View File
@@ -124,6 +124,20 @@ A list of all available rake tasks can be obtained by running:
$ sudo -u git -H gitlab-rake -T
```
## GitLab Container Registry Migration to database metadata store {#module-services-gitlab-registry-database-migration}
For a general explanation please read the [official documentation](https://docs.gitlab.com/administration/packages/container_registry_metadata_database/).
With the NixOS module, please run the following steps for the three-step import:
* `systemctl stop gitlab-container-registry`
* `sudo -u gitlab-container-registry database import --step-one --log-to-stdout /etc/gitlab-container-registry-config.json`
* `sudo -u gitlab-container-registry database import --step-two --log-to-stdout /etc/gitlab-container-registry-config.json`
* `sudo -u gitlab-container-registry database import --step-three --log-to-stdout /etc/gitlab-container-registry-config.json`
Please make sure that `services.gitlab.registry.settings.database.enabled` is `true` or `"prefer"` before restarting the
`gitlab-container-registry` systemd service.
## Runner {#module-services-gitlab-runner}
GitLab Runner is a CI runner which is an executable which you can host yourself.
nixos/modules/services/misc/gitlab.nix → nixos/modules/services/misc/gitlab/default.nix
+23 -131
View File
@@ -22,7 +22,7 @@ let
if config.services.postgresql.enable then
config.services.postgresql.package
else
pkgs.postgresql_16;
pkgs.postgresql_17;
gitlabSocket = "${cfg.statePath}/tmp/sockets/gitlab.socket";
gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
@@ -176,8 +176,8 @@ let
host = cfg.registry.externalAddress;
port = cfg.registry.externalPort;
key = cfg.registry.keyFile;
api_url = "http://${config.services.dockerRegistry.listenAddress}:${toString config.services.dockerRegistry.port}/";
issuer = cfg.registry.issuer;
api_url = "http://${cfg.registry.externalAddress}:${toString cfg.registry.externalPort}/";
issuer = cfg.registry.settings.auth.token.issuer;
};
elasticsearch.indexer_path = "${pkgs.gitlab-elasticsearch-indexer}/bin/gitlab-elasticsearch-indexer";
extra = { };
@@ -576,73 +576,6 @@ in
'';
};
registry = {
enable = mkOption {
type = types.bool;
default = false;
description = "Enable GitLab container registry.";
};
package = mkOption {
type = types.package;
default =
if versionAtLeast config.system.stateVersion "23.11" then
pkgs.gitlab-container-registry
else
pkgs.distribution;
defaultText = literalExpression "pkgs.distribution";
description = ''
Container registry package to use.
External container registries such as `pkgs.distribution` are not supported
anymore since GitLab 16.0.0.
'';
};
host = mkOption {
type = types.str;
default = config.services.gitlab.host;
defaultText = literalExpression "config.services.gitlab.host";
description = "GitLab container registry host name.";
};
port = mkOption {
type = types.port;
default = 4567;
description = "GitLab container registry port.";
};
certFile = mkOption {
type = types.path;
description = "Path to GitLab container registry certificate.";
};
keyFile = mkOption {
type = types.path;
description = "Path to GitLab container registry certificate-key.";
};
defaultForProjects = mkOption {
type = types.bool;
default = cfg.registry.enable;
defaultText = literalExpression "config.${opt.registry.enable}";
description = "If GitLab container registry should be enabled by default for projects.";
};
issuer = mkOption {
type = types.str;
default = "gitlab-issuer";
description = "GitLab container registry issuer.";
};
serviceName = mkOption {
type = types.str;
default = "container_registry";
description = "GitLab container registry service name.";
};
externalAddress = mkOption {
type = types.str;
default = "";
description = "External address used to access registry from the internet";
};
externalPort = mkOption {
type = types.port;
description = "External port used to access registry from the internet";
};
};
smtp = {
enable = mkOption {
type = types.bool;
@@ -1175,16 +1108,6 @@ in
config = mkIf cfg.enable {
warnings = [
(mkIf
(
cfg.registry.enable
&& versionAtLeast (getVersion cfg.packages.gitlab) "16.0.0"
&& cfg.registry.package == pkgs.distribution
)
''
Support for container registries other than gitlab-container-registry has ended since GitLab 16.0.0 and is scheduled for removal in a future release.
Please back up your data and migrate to the gitlab-container-registry package.''
)
(mkIf
(
versionAtLeast (getVersion cfg.packages.gitlab) "16.2.0"
@@ -1237,11 +1160,25 @@ in
assertion = cfg.secrets.activeRecordSaltFile != null;
message = "services.gitlab.secrets.activeRecordSaltFile must be set!";
}
{
assertion = versionAtLeast postgresqlPackage.version "16";
message = "PostgreSQL >= 16 is required to run GitLab 18. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
}
];
]
++
map
(x: {
assertion =
lib.versions.major (lib.getVersion cfg.packages.gitlab) == x.gitlabMajorVersion
-> lib.versionAtLeast (lib.getVersion postgresqlPackage) x.requiresMinimumPostgres;
message = "PostgreSQL >= ${x.requiresMinimumPostgres} is required to run GitLab ${x.gitlabMajorVersion}. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
})
[
{
gitlabMajorVersion = "18";
requiresMinimumPostgres = "16";
}
{
gitlabMajorVersion = "19";
requiresMinimumPostgres = "17";
}
];
environment.systemPackages = [
gitlab-rake
@@ -1335,51 +1272,6 @@ in
};
};
systemd.services.gitlab-registry-cert = optionalAttrs cfg.registry.enable {
path = with pkgs; [ openssl ];
script = ''
mkdir -p $(dirname ${cfg.registry.keyFile})
mkdir -p $(dirname ${cfg.registry.certFile})
openssl req -nodes -newkey rsa:4096 -keyout ${cfg.registry.keyFile} -out /tmp/registry-auth.csr -subj "/CN=${cfg.registry.issuer}"
openssl x509 -in /tmp/registry-auth.csr -out ${cfg.registry.certFile} -req -signkey ${cfg.registry.keyFile} -days 3650
chown ${cfg.user}:${cfg.group} $(dirname ${cfg.registry.keyFile})
chown ${cfg.user}:${cfg.group} $(dirname ${cfg.registry.certFile})
chown ${cfg.user}:${cfg.group} ${cfg.registry.keyFile}
chown ${cfg.user}:${cfg.group} ${cfg.registry.certFile}
'';
unitConfig = {
ConditionPathExists = "!${cfg.registry.certFile}";
};
serviceConfig = {
Type = "oneshot";
Slice = "system-gitlab.slice";
};
};
# Ensure Docker Registry launches after the certificate generation job
systemd.services.docker-registry = optionalAttrs cfg.registry.enable {
wants = [ "gitlab-registry-cert.service" ];
after = [ "gitlab-registry-cert.service" ];
};
# Enable Docker Registry, if GitLab-Container Registry is enabled
services.dockerRegistry = optionalAttrs cfg.registry.enable {
enable = true;
enableDelete = true; # This must be true, otherwise GitLab won't manage it correctly
package = cfg.registry.package;
port = cfg.registry.port;
extraConfig = {
auth.token = {
realm = "http${optionalString (cfg.https == true) "s"}://${cfg.host}/jwt/auth";
service = cfg.registry.serviceName;
issuer = cfg.registry.issuer;
rootcertbundle = cfg.registry.certFile;
};
};
};
# Use postfix to send out mails.
services.postfix.enable = mkDefault (cfg.smtp.enable && cfg.smtp.address == "localhost");
@@ -1910,6 +1802,6 @@ in
};
meta.doc = ./gitlab.md;
meta.doc = ./default.md;
meta.teams = [ teams.gitlab ];
}
nixos/tests/gitlab/gitlab.nix
+27 -46
View File
@@ -15,17 +15,20 @@ let
inherit (import ../ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
initialRootPassword = "notproduction";
rootProjectId = "2";
rootPAT = "root-PAT-01234567890";
aliceUsername = "alice";
aliceUserId = "2";
alicePassword = "R5twyCgU0uXC71wT9BBTCqLs6HFZ7h3L";
aliceProjectId = "1";
aliceProjectName = "test-alice";
alicePAT = "alice-PAT-0123456789";
bobUsername = "bob";
bobUserId = "3";
bobPassword = "XwkkBbl2SiIwabQzgcoaTbhsotijEEtF";
bobProjectId = "2";
bobPAT = "bob-PAT-012345678901";
in
{
name = "gitlab";
@@ -135,14 +138,6 @@ in
testScript =
{ nodes, ... }:
let
auth = pkgs.writeText "auth.json" (
builtins.toJSON {
grant_type = "password";
username = "root";
password = initialRootPassword;
}
);
createUserAlice = pkgs.writeText "create-user-alice.json" (
builtins.toJSON rec {
username = aliceUsername;
@@ -163,22 +158,6 @@ in
}
);
aliceAuth = pkgs.writeText "alice-auth.json" (
builtins.toJSON {
grant_type = "password";
username = aliceUsername;
password = alicePassword;
}
);
bobAuth = pkgs.writeText "bob-auth.json" (
builtins.toJSON {
grant_type = "password";
username = bobUsername;
password = bobPassword;
}
);
aliceAddSSHKey = pkgs.writeText "alice-add-ssh-key.json" (
builtins.toJSON {
id = aliceUserId;
@@ -235,9 +214,10 @@ in
gitlab.wait_for_unit("gitlab.service")
gitlab.wait_for_unit("gitlab-pages.service")
gitlab.wait_for_unit("gitlab-sidekiq.service")
gitlab.wait_for_unit("gitlab.target")
gitlab.wait_for_file("${nodes.gitlab.services.gitlab.statePath}/tmp/sockets/gitlab.socket")
gitlab.wait_until_succeeds("curl -sSf http://gitlab/users/sign_in")
gitlab.wait_for_unit("docker-registry.service")
gitlab.wait_for_unit("gitlab-container-registry.service")
'';
# The actual test of GitLab. Only push data to GitLab if
@@ -251,27 +231,27 @@ in
"curl -isSf http://gitlab | grep -i location | grep http://gitlab/users/sign_in"
)
gitlab.succeed(
"${pkgs.sudo}/bin/sudo -u gitlab -H gitlab-rake gitlab:check 1>&2"
)
gitlab.succeed(
"echo \"Authorization: Bearer $(curl -X POST -H 'Content-Type: application/json' -d @${auth} http://gitlab/oauth/token | ${pkgs.jq}/bin/jq -r '.access_token')\" >/tmp/headers"
"/run/wrappers/bin/sudo -u gitlab -H gitlab-rake gitlab:check 1>&2"
)
''
+ lib.optionalString doSetup ''
gitlab.succeed(
"/run/wrappers/bin/sudo -u gitlab gitlab-rails runner \"token = User.find_by_username('root').personal_access_tokens.create(scopes: ['api'], name: 'Test Token', expires_at: 365.days.from_now); token.set_token('${rootPAT}'); token.save!\""
)
with subtest("Create user Alice"):
gitlab.succeed(
"""[ "$(curl -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H @/tmp/headers -d @${createUserAlice} http://gitlab/api/v4/users)" = "201" ]"""
"""[ "$(curl -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H 'Authorization: Bearer ${rootPAT}' -d @${createUserAlice} http://gitlab/api/v4/users)" = "201" ]"""
)
gitlab.succeed(
"echo \"Authorization: Bearer $(curl -X POST -H 'Content-Type: application/json' -d @${aliceAuth} http://gitlab/oauth/token | ${pkgs.jq}/bin/jq -r '.access_token')\" >/tmp/headers-alice"
"/run/wrappers/bin/sudo -u gitlab gitlab-rails runner \"token = User.find_by_username('alice').personal_access_tokens.create(scopes: ['api'], name: 'Test Token', expires_at: 365.days.from_now); token.set_token('${alicePAT}'); token.save!\""
)
with subtest("Create user Bob"):
gitlab.succeed(
""" [ "$(curl -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H @/tmp/headers -d @${createUserBob} http://gitlab/api/v4/users)" = "201" ]"""
""" [ "$(curl -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H 'Authorization: Bearer ${rootPAT}' -d @${createUserBob} http://gitlab/api/v4/users)" = "201" ]"""
)
gitlab.succeed(
"echo \"Authorization: Bearer $(curl -X POST -H 'Content-Type: application/json' -d @${bobAuth} http://gitlab/oauth/token | ${pkgs.jq}/bin/jq -r '.access_token')\" >/tmp/headers-bob"
"/run/wrappers/bin/sudo -u gitlab gitlab-rails runner \"token = User.find_by_username('bob').personal_access_tokens.create(scopes: ['api'], name: 'Test Token', expires_at: 365.days.from_now); token.set_token('${bobPAT}'); token.save!\""
)
with subtest("Setup Git and SSH for Alice"):
@@ -287,7 +267,7 @@ in
-w '%{http_code}' \
-X POST \
-H 'Content-Type: application/json' \
-H @/tmp/headers-alice -d @${aliceAddSSHKey} \
-H 'Authorization: Bearer ${alicePAT}' -d @${aliceAddSSHKey} \
http://gitlab/api/v4/user/keys)" = "201" ]
"""
)
@@ -301,7 +281,7 @@ in
-w '%{http_code}' \
-X POST \
-H 'Content-Type: application/json' \
-H @/tmp/headers-alice \
-H 'Authorization: Bearer ${alicePAT}' \
-d @${createProjectAlice} \
http://gitlab/api/v4/projects)" = "201" ]
"""
@@ -315,7 +295,7 @@ in
-w '%{http_code}' \
-X POST \
-H 'Content-Type: application/json' \
-H @/tmp/headers-alice \
-H 'Authorization: Bearer ${alicePAT}' \
-d @${putFile} \
http://gitlab/api/v4/projects/${aliceProjectId}/repository/files/some-file.txt)" = "201" ]"""
)
@@ -363,7 +343,7 @@ in
-w '%{http_code}' \
-X POST \
-H 'Content-Type: application/json' \
-H @/tmp/headers-bob \
-H 'Authorization: Bearer ${bobPAT}' \
http://gitlab/api/v4/projects/${aliceProjectId}/fork)" = "201" ]
"""
)
@@ -376,7 +356,7 @@ in
-w '%{http_code}' \
-X POST \
-H 'Content-Type: application/json' \
-H @/tmp/headers-bob \
-H 'Authorization: Bearer ${bobPAT}' \
-d @${putFile} \
http://gitlab/api/v4/projects/${bobProjectId}/repository/files/some-other-file.txt)" = "201" ]
"""
@@ -391,7 +371,7 @@ in
-w '%{http_code}' \
-X POST \
-H 'Content-Type: application/json' \
-H @/tmp/headers-bob \
-H 'Authorization: Bearer ${bobPAT}' \
-d @${mergeRequest} \
http://gitlab/api/v4/projects/${bobProjectId}/merge_requests)" = "201" ]
"""
@@ -405,7 +385,7 @@ in
-w '%{http_code}' \
-X PUT \
-H 'Content-Type: application/json' \
-H @/tmp/headers-alice \
-H 'Authorization: Bearer ${alicePAT}' \
-d @${mergeRequest} \
http://gitlab/api/v4/projects/${aliceProjectId}/merge_requests/1/merge)" = "200" ]
"""
@@ -419,7 +399,7 @@ in
-w '%{http_code}' \
-X POST \
-H 'Content-Type: application/json' \
-H @/tmp/headers-bob \
-H 'Authorization: Bearer ${bobPAT}' \
-d @${newIssue} \
http://gitlab/api/v4/projects/${aliceProjectId}/issues)" = "201" ]
"""
@@ -433,7 +413,7 @@ in
-w '%{http_code}' \
-X PUT \
-H 'Content-Type: application/json' \
-H @/tmp/headers-alice -d @${closeIssue} http://gitlab/api/v4/projects/${aliceProjectId}/issues/1)" = "200" ]
-H 'Authorization: Bearer ${alicePAT}' -d @${closeIssue} http://gitlab/api/v4/projects/${aliceProjectId}/issues/1)" = "200" ]
"""
)
''
@@ -444,14 +424,14 @@ in
[ "$(curl \
-o /dev/null \
-w '%{http_code}' \
-H @/tmp/headers-alice \
-H 'Authorization: Bearer ${alicePAT}' \
http://gitlab/api/v4/projects/${aliceProjectId}/repository/archive.tar.gz)" = "200" ]
"""
)
gitlab.succeed(
"""
curl \
-H @/tmp/headers-alice \
-H 'Authorization: Bearer ${alicePAT}' \
http://gitlab/api/v4/projects/${aliceProjectId}/repository/archive.tar.gz > /tmp/archive.tar.gz
"""
)
@@ -463,14 +443,14 @@ in
[ "$(curl \
-o /dev/null \
-w '%{http_code}' \
-H @/tmp/headers-alice \
-H 'Authorization: Bearer ${alicePAT}' \
http://gitlab/api/v4/projects/${aliceProjectId}/repository/archive.tar.bz2)" = "200" ]
"""
)
gitlab.succeed(
"""
curl \
-H @/tmp/headers-alice \
-H 'Authorization: Bearer ${alicePAT}' \
http://gitlab/api/v4/projects/${aliceProjectId}/repository/archive.tar.bz2 > /tmp/archive.tar.bz2
"""
)
@@ -506,6 +486,7 @@ in
"sudo -u gitlab -H gitlab-rake gitlab:backup:restore RAILS_ENV=production BACKUP=dump force=yes"
)
gitlab.systemctl("start gitlab.target")
gitlab.systemctl("start gitlab-container-registry")
''
+ waitForServices
+ ''
nixos/tests/gitlab/runner.nix
-9
View File
@@ -137,14 +137,6 @@ in
testScript =
{ nodes, ... }:
let
authPayload = pkgs.writeText "auth.json" (
builtins.toJSON {
grant_type = "password";
username = "root";
password = initialRootPassword;
}
);
runnerTokenEnv = pkgs.writeText "runner-token.env" ''
CI_SERVER_URL=http://gitlab
CI_SERVER_TOKEN=$token
@@ -162,7 +154,6 @@ in
JQ_BINARY="${pkgs.jq}/bin/jq"
GITLAB_STATE_PATH="${nodes.gitlab.services.gitlab.statePath}"
RUNNER_TOKEN_ENV_FILE="${runnerTokenEnv}"
AUTH_PAYLOAD_FILE="${authPayload}"
CREATE_RUNNER_PAYLOAD_FILE="${createRunnerPayload}"
${lib.readFile ./runner_test.py}
nixos/tests/gitlab/runner_test.py
+5 -10
View File
@@ -26,7 +26,6 @@ class Nix:
jq: str
gitlab_state_path: str
create_runner_payload_file: str
auth_payload_file: str
runner_token_env_file: str
@@ -35,12 +34,12 @@ out_dir = os.environ.get("out", os.getcwd())
nix = Nix(
jq=JQ_BINARY,
gitlab_state_path=GITLAB_STATE_PATH,
auth_payload_file=AUTH_PAYLOAD_FILE,
create_runner_payload_file=CREATE_RUNNER_PAYLOAD_FILE,
runner_token_env_file=RUNNER_TOKEN_ENV_FILE,
)
vms = Machines(gitlab, gitlab_runner)
runnerConfigs: dict[str, Runner] = {}
rootPAT = "root-PAT-01234567890"
def wait_for_services():
@@ -63,15 +62,11 @@ def test_connection():
)
vms.gitlab.succeed(
f"echo \"Authorization: Bearer $(curl -X POST -H 'Content-Type: application/json' -d @{nix.auth_payload_file} http://gitlab/oauth/token | {nix.jq} -r '.access_token')\" >/tmp/headers"
f"/run/wrappers/bin/sudo -u gitlab gitlab-rails runner \"token = User.find_by_username('root').personal_access_tokens.create(scopes: ['api'], name: 'Test Token', expires_at: 365.days.from_now); token.set_token('{rootPAT}'); token.save!\""
)
vms.gitlab.copy_from_vm("/tmp/headers")
out_dir = os.environ.get("out", os.getcwd())
vms.gitlab_runner.copy_from_host(str(Path(out_dir, "headers")), "/tmp/headers")
print("==> Testing connection.")
vms.gitlab_runner.succeed("curl -v -H @/tmp/headers http://gitlab/api/v4/version")
vms.gitlab_runner.succeed(f"curl -v -H 'Authorization: Bearer {rootPAT}' http://gitlab/api/v4/version")
def test_register_runner(name: str, tokenFile: str):
@@ -93,7 +88,7 @@ def test_register_runner(name: str, tokenFile: str):
f"""
curl -s -X POST \
-H 'Content-Type: application/json' \
-H @/tmp/headers \
-H 'Authorization: Bearer {rootPAT}' \
-d @{nix.create_runner_payload_file} \
http://gitlab/api/v4/user/runners
"""
@@ -138,7 +133,7 @@ def test_runner_registered(r: Runner):
f"""
curl -s -X GET \
-H 'Content-Type: application/json' \
-H @/tmp/headers \
-H 'Authorization: Bearer {rootPAT}' \
http://gitlab/api/v4/runners/{r.id}"""
)[1]
runnerStatus = json.loads(resp)
pkgs/by-name/gi/gitaly/package.nix
+3 -3
View File
@@ -7,7 +7,7 @@
}:
let
version = "18.11.7";
version = "19.0.4";
package_version = "v${lib.versions.major version}";
gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
@@ -21,10 +21,10 @@ let
owner = "gitlab-org";
repo = "gitaly";
rev = "v${version}";
hash = "sha256-CupoX+Jv/4JDn50T7KF4+k9dd2bL+1zWd+3BsFIKOM8=";
hash = "sha256-IkOS2XYo+QkLkhodeqmzz5bR2FxMG68hUsT357h7cKo=";
};
vendorHash = "sha256-/RJnCcmUoqGy08MSGEVM/taV1qZK65kiZw19n6S3ZQ0=";
vendorHash = "sha256-oc+H5DV2B++buxH2LI0BoaWjDUVJGRcbuofnIX69ddI=";
ldflags = [
"-X ${gitaly_package}/internal/version.version=${version}"
pkgs/by-name/gi/gitlab-container-registry/package.nix
+3 -3
View File
@@ -6,7 +6,7 @@
buildGo125Module rec {
pname = "gitlab-container-registry";
version = "4.39.0";
version = "4.40.2";
rev = "v${version}-gitlab";
# nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGo125Module rec {
owner = "gitlab-org";
repo = "container-registry";
inherit rev;
hash = "sha256-7dGKV2Pc3OPdM4OZqYjp3B9/s6DHtPvrqcWnWb3wHYw=";
hash = "sha256-k94uEM2VoOtdFRXWm6CDmeRt8LMXSNegRGes3ZKPg0I=";
};
vendorHash = "sha256-s08LsgYZTRJm0sWkbEUsmTYGkfb/5PJl9o9ozY1KOms=";
vendorHash = "sha256-MD98JYwTo/t5/E7clIlUfjmv8t7nDPpVElbuYDRjMMc=";
excludedPackages = [
"devvm/*"
pkgs/by-name/gi/gitlab-pages/package.nix
+2 -2
View File
@@ -6,14 +6,14 @@
buildGoModule (finalAttrs: {
pname = "gitlab-pages";
version = "18.11.7";
version = "19.0.4";
# nixpkgs-update: no auto update
src = fetchFromGitLab {
owner = "gitlab-org";
repo = "gitlab-pages";
rev = "v${finalAttrs.version}";
hash = "sha256-AW/zzQiiGz8JBw1c5JAwo2boWKoeD1wx0dUA4nOyARA=";
hash = "sha256-hadZk9ghc1bNJTSsonyiKsJcMiHxkvQb/lifcE3EVyw=";
};
vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";
pkgs/by-name/gi/gitlab-shell/package.nix
+2 -2
View File
@@ -8,14 +8,14 @@
buildGoModule (finalAttrs: {
pname = "gitlab-shell";
version = "14.50.0";
version = "14.51.0";
# nixpkgs-update: no auto update
src = fetchFromGitLab {
owner = "gitlab-org";
repo = "gitlab-shell";
rev = "v${finalAttrs.version}";
hash = "sha256-a9s+TCm5yKPjNh+BD9fm6iVA4H9KJiMyWNulY+7BKZo=";
hash = "sha256-x/dondbgw8bJGovZ7arKrxRqdEmNW8AYYgaL6UfjsZo=";
};
buildInputs = [
pkgs/by-name/gi/gitlab/data.json
+9 -9
View File
@@ -1,17 +1,17 @@
{
"version": "18.11.7",
"repo_hash": "sha256-LSrdAz4bt5h3Z2V4vlazH5hKoq3LNvoRz02AyUb4Ka4=",
"yarn_hash": "sha256-og09R28lwYvDk4pe7z1dRMaanYiTsUSx+SUKoWc53do=",
"version": "19.0.4",
"repo_hash": "sha256-qDHaYzy+GfaGPsshIUq9AO5VSZzTErruy9YCUlgLBYs=",
"yarn_hash": "sha256-maKKpsAgbpVEB9DBkpe/ipGvK+5l1/gSRsNccK61iy8=",
"frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
"owner": "gitlab-org",
"repo": "gitlab",
"rev": "v18.11.7-ee",
"rev": "v19.0.4-ee",
"passthru": {
"GITALY_SERVER_VERSION": "18.11.7",
"GITLAB_KAS_VERSION": "18.11.7",
"GITLAB_PAGES_VERSION": "18.11.7",
"GITLAB_SHELL_VERSION": "14.50.0",
"GITALY_SERVER_VERSION": "19.0.4",
"GITLAB_KAS_VERSION": "19.0.4",
"GITLAB_PAGES_VERSION": "19.0.4",
"GITLAB_SHELL_VERSION": "14.51.0",
"GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.7",
"GITLAB_WORKHORSE_VERSION": "18.11.7"
"GITLAB_WORKHORSE_VERSION": "19.0.4"
}
}
pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+2 -2
View File
@@ -10,7 +10,7 @@ in
buildGoModule (finalAttrs: {
pname = "gitlab-workhorse";
version = "18.11.7";
version = "19.0.4";
# nixpkgs-update: no auto update
src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
sourceRoot = "${finalAttrs.src.name}/workhorse";
vendorHash = "sha256-X1+neA2g61BR1VRKXzeqNath0+SYXRbU4vzEg1KD2sY=";
vendorHash = "sha256-4uSwO74tfoT7QV3fUa2F1i9v6JLOuzTLPcBVpEvloXA=";
buildInputs = [ git ];
ldflags = [ "-X main.Version=${finalAttrs.version}" ];
doCheck = false;
pkgs/by-name/gi/gitlab/package.nix
+1 -1
View File
@@ -135,7 +135,7 @@ let
cp Cargo.lock $out
'';
hash = "sha256-KIMs5Zed6mcbq06oxA2eVHLfifSlcfJvACZMblDQC3M=";
hash = "sha256-BRbBijOg2nQK2Nzrkpk7mwCjr+AaF3D/3HUrS5GwIz4=";
};
postPatch = ''
pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+48 -72
View File
@@ -6,12 +6,6 @@ end
source 'https://rubygems.org'
if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this verification is still experimental
$LOAD_PATH.unshift(File.expand_path("gems/bundler-checksum/lib", __dir__))
require 'bundler-checksum'
BundlerChecksum.patch!
end
# Please see https://docs.gitlab.com/ee/development/feature_categorization/#gemfile
ignore_feature_category = Module.new do
def gem(*arguments, feature_category: nil, **keyword_arguments) # rubocop:disable Lint/UnusedMethodArgument -- Ignoring feature_category intentionally
@@ -21,33 +15,30 @@ end
extend ignore_feature_category
gem 'bundler-checksum', '~> 0.1.0', path: 'gems/bundler-checksum', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# Deprecated
gem 'bundler-checksum', '~> 0.1.0', path: 'gems/bundler-checksum', require: false, feature_category: :rails_platform
gem 'auto_freeze', path: 'gems/auto_freeze', feature_category: :rails_platform
# See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails
gem 'rails', '~> 7.2.3', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'rails', '~> 7.2.3', feature_category: :rails_platform
# Pin Zeitwerk until https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/9408 is fixed
gem 'zeitwerk', '= 2.6.18', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'zeitwerk', '= 2.6.18', feature_category: :rails_platform
gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab', feature_category: :rails_platform
gem 'gitlab-database-data_isolation', path: 'gems/gitlab-database-data_isolation', feature_category: :organization
gem 'action_dispatch-draw_all',
path: 'gems/action_dispatch-draw_all',
require: 'action_dispatch/draw_all',
feature_category: :tooling
feature_category: :rails_platform
# Need by Rails
gem 'drb', '~> 2.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'drb', '~> 2.2', feature_category: :rails_platform
gem 'bootsnap', '~> 1.23.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'bootsnap', '~> 1.24.0', require: false, feature_category: :rails_platform
# Avoid the precompiled native gems because Omnibus needs to build this to ensure
# LD_LIBRARY_PATH is correct: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7730
if RUBY_PLATFORM.include?('darwin')
gem 'ffi', '~> 1.17.3', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
else
gem 'ffi', '~> 1.17.3', force_ruby_platform: true, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
end
gem 'ffi', '~> 1.17.3', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'openssl', '~> 3.3.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -63,10 +54,10 @@ gem 'gitlab-backup-cli', path: 'gems/gitlab-backup-cli', require: 'gitlab/backup
gem 'gitlab-secret_detection', '< 1.0', feature_category: :secret_detection
# Responders respond_to and respond_with
gem 'responders', '~> 3.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'responders', '~> 3.0', feature_category: :rails_platform
gem 'sprockets', '~> 3.7.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'sprockets-rails', '~> 3.5.1', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'sprockets', '~> 3.7.0', feature_category: :rails_platform
gem 'sprockets-rails', '~> 3.5.1', feature_category: :rails_platform
gem 'view_component', '~> 3.23.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -92,7 +83,7 @@ gem 'devise-pbkdf2-encryptable', '~> 0.0.0', path: 'vendor/gems/devise-pbkdf2-en
feature_category: :system_access
gem 'bcrypt', '~> 3.1', '>= 3.1.14', feature_category: :system_access
gem 'doorkeeper', '~> 5.8', '>= 5.8.1', feature_category: :system_access
gem 'doorkeeper-openid_connect', '~> 1.8.10', feature_category: :system_access
gem 'doorkeeper-openid_connect', '~> 1.9.0', feature_category: :system_access
gem 'doorkeeper-device_authorization_grant', '~> 1.0.0', feature_category: :system_access
gem 'rexml', '~> 3.4.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'ruby-saml', '~> 1.18', feature_category: :system_access
@@ -129,7 +120,7 @@ gem 'akismet', '~> 3.0', feature_category: :insider_threat
gem 'invisible_captcha', '~> 2.3.0', feature_category: :insider_threat
# Two-factor authentication
gem 'devise-two-factor', '~> 5.1.0', feature_category: :system_access
gem 'devise-two-factor', '~> 6.4.0', feature_category: :system_access
gem 'rqrcode', '~> 2.2', feature_category: :system_access
gem 'webauthn', '~> 3.0', feature_category: :system_access
@@ -163,10 +154,10 @@ gem 'grape-swagger', '~> 2.1.2', group: [:development, :test], feature_category:
gem 'grape-swagger-entity', '~> 0.7.0', group: [:development, :test], feature_category: :api
gem 'grape-path-helpers', '~> 2.0.1', feature_category: :api
gem 'gitlab-grape-openapi', path: 'gems/gitlab-grape-openapi', feature_category: :api
gem 'rack-cors', '~> 2.0.1', require: 'rack/cors', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'rack-cors', '~> 2.0.1', require: 'rack/cors', feature_category: :api
# GraphQL API
gem 'graphql', '2.5.11', feature_category: :api
gem 'graphql', '2.5.23', feature_category: :api
gem 'graphql-docs', '~> 5.2.0', group: [:development, :test], feature_category: :api
gem 'apollo_upload_server', '~> 2.1.6', feature_category: :api
@@ -177,7 +168,7 @@ gem 'gitlab-topology-service-client', '~> 0.1',
feature_category: :cell
# Duo Workflow
gem 'gitlab-duo-workflow-service-client', '~> 0.7',
gem 'gitlab-duo-workflow-service-client', '~> 0.8',
path: 'vendor/gems/gitlab-duo-workflow-service-client',
feature_category: :duo_agent_platform
@@ -213,7 +204,7 @@ gem 'fog-local', '~> 0.8', feature_category: :shared # rubocop:todo Gemfile/Miss
# We may want to update this dependency if this is ever addressed upstream, e.g. via
# https://github.com/aliyun/aliyun-oss-ruby-sdk/pull/93
gem 'fog-aliyun', '~> 0.4', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'gitlab-fog-azure-rm', '~> 2.4.0', require: 'fog/azurerm', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'gitlab-fog-azure-rm', '~> 2.5.0', require: 'fog/azurerm', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# for Google storage
@@ -276,7 +267,7 @@ gem 'tanuki_emoji', '~> 0.13', feature_category: :markdown
gem 'unicode-emoji', '~> 4.0', feature_category: :markdown
# Calendar rendering
gem 'icalendar', '~> 2.10.1', feature_category: :team_planning
gem 'icalendar', '~> 2.12.0', feature_category: :team_planning
# Diffs
gem 'diffy', '~> 3.4', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -288,7 +279,7 @@ gem 'rack', '~> 2.2.9', feature_category: :shared # rubocop:todo Gemfile/Missing
gem 'rack-timeout', '~> 0.7.0', require: 'rack/timeout/base', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
group :puma do
gem 'puma', '~> 7.2', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'puma', '~> 8.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'sd_notify', '~> 0.1.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
end
@@ -351,7 +342,7 @@ gem 'slack-messenger', '~> 2.3.5', feature_category: :integrations
gem 'kubeclient', '~> 4.12.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# AI
gem 'circuitbox', '2.0.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'circuitbox', '2.0.0', feature_category: :ai_abstraction_layer
# Sanitize user input
gem 'sanitize', '~> 6.0.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -361,12 +352,7 @@ gem 'babosa', '~> 2.0', feature_category: :shared # rubocop:todo Gemfile/Missing
gem 'loofah', '~> 2.25.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# Used to provide license templates
gem 'licensee', '~> 9.16', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# Pinned below 1.8 so rugged.so links libgit2's old http-parser instead of
# the bundled llhttp, which collides with llhttp-ffi symbols at runtime.
# See https://gitlab.com/gitlab-org/gitlab/-/issues/598564
gem 'rugged', '~> 1.7.2', require: false, feature_category: :gitaly
gem 'licensee', '~> 10', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# Detect and convert string character encoding
gem 'charlock_holmes', '~> 0.7.9', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -391,7 +377,7 @@ gem 'addressable', '~> 2.8', feature_category: :shared # rubocop:todo Gemfile/Mi
gem 'gon', '~> 6.5.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'request_store', '~> 1.7.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'base32', '~> 0.3.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'gitlab-license', '~> 2.6', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'gitlab-license', '~> 2.6', feature_category: :plan_provisioning
# Protect against bruteforcing
gem 'rack-attack', '~> 6.8.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -409,7 +395,7 @@ gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation', feature_c
gem 'gitlab-http', path: 'gems/gitlab-http', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'premailer-rails', '~> 1.12.0', feature_category: :notifications
gem 'gitlab-labkit', '~> 1.5.0', feature_category: :error_budgets
gem 'gitlab-labkit', '~> 2.0.0', feature_category: :error_budgets
gem 'thrift', '~> 0.22.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# I18n
@@ -436,7 +422,7 @@ gem 'prometheus-client-mmap', '~> 1.5.0', require: 'prometheus/client', feature_
# Event-driven reactor for Ruby
# Required manually in config/initializers/require_async_gem
gem 'async', '~> 2.32.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'async', '~> 2.39.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'io-event', '~> 1.14', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# Security report schemas used to validate CI job artifacts of security jobs
@@ -486,7 +472,7 @@ group :development do
gem 'rubocop', feature_category: :tooling, require: false
gem 'debug', '~> 1.11.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'solargraph', '~> 0.54.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'solargraph', '~> 0.58.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'solargraph-rspec', '~> 0.5.1', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'letter_opener_web', '~> 3.0.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -507,7 +493,8 @@ group :development do
# Used by
# * `lib/tasks/gitlab/security/update_banned_ssh_keys.rake`
# * `lib/tasks/gitlab/db/migration_squash.rake`
gem 'git', '~> 1.8', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# * `lib/gitlab/diff/diff_refs.rb`
gem 'git', '~> 1.8', feature_category: :source_code_management
end
group :development, :test do
@@ -529,7 +516,7 @@ group :development, :test do
gem 'spring', '~> 4.3.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'spring-commands-rspec', '~> 1.0.4', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'gitlab-styles', '~> 13.1.0', feature_category: :tooling, require: false
gem 'gitlab-styles', '~> 14.0', feature_category: :tooling, require: false
gem 'haml_lint', '~> 0.58', feature_category: :tooling, require: false
# Benchmarking & profiling
@@ -553,26 +540,17 @@ group :development, :test do
gem 'gitlab-housekeeper', path: 'gems/gitlab-housekeeper', feature_category: :tooling
gem 'yard', '~> 0.9', require: false, feature_category: :tooling
end
group :development, :test, :danger do
gem 'gitlab-dangerfiles', '~> 4.10.0', require: false, feature_category: :tooling
end
# Gems required for Dangerfile
gem 'gitlab-dangerfiles', '~> 4.11.1', require: false, feature_category: :tooling
group :development, :test, :coverage do
# Gems required for code coverage
gem 'simplecov', '~> 0.22', require: false, feature_category: :tooling
gem 'simplecov-lcov', '~> 0.8.0', require: false, feature_category: :tooling
gem 'simplecov-cobertura', '~> 3.1.0', require: false, feature_category: :tooling
gem 'undercover', '~> 0.8.0', require: false, feature_category: :tooling
end
# Gems required in omnibus-gitlab pipeline
group :development, :test, :omnibus do
gem 'license_finder', '~> 7.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
end
# Gems required in various pipelines
group :development, :test, :monorepo do
# Gems required in various pipelines
gem 'gitlab-rspec', path: 'gems/gitlab-rspec', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'gitlab-rspec_flaky', path: 'gems/gitlab-rspec_flaky', feature_category: :tooling
end
@@ -589,11 +567,6 @@ group :test do
gem 'graphlyte', '~> 1.0.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# Upload CI metrics to a GCP BigQuery instance
#
# We only use this gem in CI.
gem 'google-cloud-bigquery', '~> 1.0', feature_category: :tooling
gem 'shoulda-matchers', '~> 6.4.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'email_spec', '~> 2.3.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'webmock', '~> 3.26.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -608,7 +581,7 @@ group :test do
# Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
gem 'derailed_benchmarks', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'gitlab_quality-test_tooling', '~> 3.10.0', require: false, feature_category: :tooling
gem 'gitlab_quality-test_tooling', '~> 3.14.0', require: false, feature_category: :tooling
end
gem 'octokit', '~> 9.0', feature_category: :importers
@@ -617,7 +590,7 @@ gem 'faraday-multipart', '~> 1.0', feature_category: :importers
gem 'gitlab-mail_room', '~> 1.0.0', require: 'mail_room', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'email_reply_trimmer', '~> 0.1', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'email_reply_trimmer', '~> 0.1', feature_category: :team_planning
gem 'html2text', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'stackprof', '~> 0.2.26', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -632,10 +605,10 @@ gem 'health_check', '~> 3.0', feature_category: :shared # rubocop:todo Gemfile/M
# System information
gem 'vmstat', '~> 2.3.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'sys-filesystem', '~> 1.4.3', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'sys-filesystem', '~> 1.5.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# NTP client
gem 'net-ntp', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'net-ntp', feature_category: :geo_replication
# SSH keys support
gem 'ssh_data', '~> 2.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -644,13 +617,13 @@ gem 'ssh_data', '~> 2.0', feature_category: :shared # rubocop:todo Gemfile/Missi
gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat
# Gitaly GRPC protocol definitions
gem 'gitaly', '~> 18.10.0', feature_category: :gitaly
gem 'gitaly', '~> 18.11.0', feature_category: :gitaly
# KAS GRPC protocol definitions
gem 'gitlab-kas-grpc', '~> 18.5.0-rc4', feature_category: :deployment_management
# Knowledge Graph GRPC protocol definitions
gem 'gitlab-gkg-proto', '~> 0.7.0', feature_category: :knowledge_graph
gem 'gitlab-gkg-proto', '~> 0.37.0', feature_category: :knowledge_graph
gem 'grpc', '~> 1.80.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -662,7 +635,7 @@ gem 'toml-rb', '~> 4.1', feature_category: :shared # rubocop:todo Gemfile/Missin
gem 'flipper', '~> 1.3.6', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'flipper-active_record', '~> 1.3.6', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'flipper-active_support_cache_store', '~> 1.3.6', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'unleash', '~> 3.2.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'unleash', '~> 3.2.2', feature_category: :feature_flags # https://docs.gitlab.com/operations/feature_flags/
gem 'gitlab-experiment', '~> 1.3.0', feature_category: :acquisition
# Structured logging
@@ -727,7 +700,7 @@ gem 'cvss-suite', '~> 4.1.1', require: 'cvss_suite', feature_category: :software
gem 'arr-pm', '~> 0.0.12', feature_category: :package_registry
# Remote Development
gem 'devfile', '~> 0.5.0', feature_category: :workspaces
gem 'devfile', '~> 0.5.1', feature_category: :workspaces
gem 'hashdiff', '~> 1.2.0', feature_category: :workspaces
# Apple plist parsing
@@ -764,10 +737,13 @@ gem "gitlab-cloud-connector", "~> 1.45", require: 'gitlab/cloud_connector', feat
gem "gvltools", "~> 0.4.0", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
gem 'gitlab_query_language', '~> 0.26.0', feature_category: :integrations
gem 'gitlab_query_language', '~> 0.27.1', feature_category: :integrations
# standard Gem, version increase to resolve vulnerabilities
gem "zlib", "~> 3.2", ">= 3.2.3", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/work_items/596593
# standard Gem, pin version to resolve vulnerabilities
# Gems required in omnibus-gitlab pipeline
gem 'license_finder', '~> 7.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
# standard Gem, pin version to resolve vulnerabilities and match omnibus-gitlab
gem "erb", "= 4.0.3.1", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/work_items/596593
pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
Generated
+418 -235
View File
File diff suppressed because it is too large Load Diff
pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
Generated
+276 -226
View File
File diff suppressed because it is too large Load Diff