Skip to content

fix(gitlab): restore group variable fallback to wildcard environment_scope and correct precedence#4965

Merged
Skarlso merged 3 commits intoexternal-secrets:mainfrom
Aakkash-Suresh:fix/gitlab-group-wildcard-fallback-4953
Jul 2, 2025
Merged

fix(gitlab): restore group variable fallback to wildcard environment_scope and correct precedence#4965
Skarlso merged 3 commits intoexternal-secrets:mainfrom
Aakkash-Suresh:fix/gitlab-group-wildcard-fallback-4953

Conversation

@Aakkash-Suresh
Copy link
Copy Markdown
Contributor

@Aakkash-Suresh Aakkash-Suresh commented Jun 28, 2025

Problem Statement

What is the problem you're trying to solve?
Group-level GitLab variables with environment_scope = "*" (“All (default)”) are not being retrieved when a specific environment is set in the SecretStore. This causes expected secrets to be missing in common GitLab setups.

Related Issue

Fixes #4953

Proposed Changes

  • Added fallback logic for group variables: if a variable is not found for the specific environment, the provider now also checks for variables with environment_scope = "*", matching the behavior for project variables.
  • Corrected the precedence logic so that:
    • Project environment variable > Project wildcard variable > Group environment variable > Group wildcard variable.
  • Updated and added tests to ensure the correct fallback and precedence behavior.

Checklist

  • I have read the contribution guidelines
  • All commits are signed with git commit --signoff
  • My changes have reasonable test coverage
  • All tests pass with make test
  • I ensured my PR is ready for review with make reviewable

@Aakkash-Suresh Aakkash-Suresh requested a review from a team as a code owner June 28, 2025 06:11
@Aakkash-Suresh Aakkash-Suresh marked this pull request as draft June 28, 2025 06:15
Signed-off-by: Aakkash-Suresh <i-aakkash.s@devrev.ai>
@Aakkash-Suresh Aakkash-Suresh force-pushed the fix/gitlab-group-wildcard-fallback-4953 branch from 16c6c84 to 8571868 Compare June 28, 2025 06:17
@Aakkash-Suresh Aakkash-Suresh marked this pull request as ready for review June 28, 2025 06:18
Signed-off-by: Aakkash-Suresh <i-aakkash.s@devrev.ai>
@Aakkash-Suresh
Copy link
Copy Markdown
Contributor Author

@gusfcarvalho, would you mind taking a look at this PR when you have a moment? Thank you!

@Aakkash-Suresh
Copy link
Copy Markdown
Contributor Author

@gusfcarvalho just a gentle reminder on this PR when you have a chance.

@Skarlso
Copy link
Copy Markdown
Contributor

Skarlso commented Jul 2, 2025

Thanks for the fix!

@Skarlso Skarlso merged commit 8e8466b into external-secrets:main Jul 2, 2025
2 checks passed
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Jul 2, 2025

alliseeisgold pushed a commit to alliseeisgold/external-secrets that referenced this pull request Jul 10, 2025
…scope and correct precedence (external-secrets#4965)

* fix(gitlab): fallback to group wildcard variables and fix precedence

Signed-off-by: Aakkash-Suresh <i-aakkash.s@devrev.ai>

* refactor(gitlab): reduce cognitive complexity in fetchProjectVariables

Signed-off-by: Aakkash-Suresh <i-aakkash.s@devrev.ai>

---------

Signed-off-by: Aakkash-Suresh <i-aakkash.s@devrev.ai>
Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
Signed-off-by: asrormirzoev <asrormirzoev@yandex-team.ru>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

GitLab secrets with environment “All (default)” at group level are no longer retrieved

2 participants