Setup accounts for invent.kde.org (KDE GitLab)

[lachmanfrantisek]

@Conan-Kudo has asked us to support KDE GitLab hosted on invent.kde.org.

For the basic functionality, the only task is to:

• Set up accounts.
  • Create an account for the prod instance.
  • Create an account for the stage instance.
  • Create tokens and put those as secrets to Bitwarden.
• Enhance the validation (we need to do this not lose the account).
  • Clone the task pull requests.
  • Enhance the cron job to run a periodic check.

[Conan-Kudo]

cc: @nicolas17

[Conan-Kudo]

cc: @bcooksley

[bcooksley]

Can I please get some details on what the accounts will be used for and how Packit will be interacting with invent.kde.org?

[lachmanfrantisek]

@bcooksley , @Conan-Kudo sorry for forgetting a bit about the issue -- is this still relevant to you?

To answer Ben's question, Packit needs to interact with GitLab through a (regular) user since GitLab does not have anything like GitHub applications to handle installation/authentication. It works like this:

• For communication from GitLab to Packit, a user needs to set up a webhook for the project/namespace.
• For communication from Packit to GitLab (e.g. set a CI status, add a comment,...), we have this GitLab user connecting to GitLab's API via our OGR library.

In practice, we usually set up two accounts (one for stage, one for production) and ideally one extra for regular outside-of-deployment validation. (We regularly trigger the Packit's job on pre-prepared pull requests and check if all statuses are fine.)

In short, not hard to do, we just want to be sure this will be used before doing the setup and spending resources on validation...

[bcooksley]

Neal will need to confirm if this is still relevant, but I believe it is.

In terms of deploying webhooks, we'll have to do that centrally - as we don't give out maintainer permissions on our (mainline) repositories normally. Is the format of the webhook URL predictable? (we have automation to bulk set these up for a couple of other services we provide integration with).

The Packit to Gitlab bit seems fine although to my knowledge Gitlab doesn't support externally setting CI statuses like GitHub does (I assume this is communicated via a comment?).

I can arrange for the account(s) you've requested to be setup - do you have any examples of where this has been deployed on other Gitlab instances in the past so I can see what the integration does in case I need to explain it's behaviour to the KDE Community at large?

[Conan-Kudo]

The Packit to Gitlab bit seems fine although to my knowledge Gitlab doesn't support externally setting CI statuses like GitHub does (I assume this is communicated via a comment?).

GitLab technically does as an external status check: https://docs.gitlab.com/api/status_checks/

[bcooksley]

The Packit to Gitlab bit seems fine although to my knowledge Gitlab doesn't support externally setting CI statuses like GitHub does (I assume this is communicated via a comment?).

GitLab technically does as an external status check: https://docs.gitlab.com/api/status_checks/

That is an Ultimate tier feature only available in Gitlab EE - and we run Gitlab CE (as we need to only have FOSS deployed, was a deliberate decision when migrating to Gitlab several years back)

[Conan-Kudo]

Ah oof, I didn't notice it was EEU only...