Repository navigation
[draft] Fix bundle/config/mutator/resourcemutator/apply_bundle_permissions.go - #7291
Draft
lennartkats-db wants to merge 1 commit into
Draft
lennartkats-db wants to merge 1 commit into
lennartkats-db wants to merge 1 commit into
Conversation
lennartkats-db
added
DABs
Collaborator
Integration test reportCommit: 48d7c4c
Top 6 slowest tests (at least 2 minutes):
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A group set to
CAN_VIEWin a target's permissions andCAN_MANAGE_RUNon a job in that target now keeps the job permission without an overlap warning fromApplyBundlePermissions. This removes the reported warning that blocks strict validation for this layered configuration. Root-level permission overlaps continue to warn.Before and after
Issue #7032 reports that the target and job entries for the same group produce a warning, which strict mode treats as an error. Before this change, the mutator retained the job permission but warned about the target entry. After this change, it recognizes the selected target's portion of the merged permission list and skips that warning when the same group has an explicit job permission. It still warns when the root-level entry overlaps the job.
Verification
TestTargetGroupPermissionOverridesJobWithoutWarningfailed on base3aa5c9607bff73d3fb18a4c6e63b9f03235f3de7and passed at head48d7c4c5fdd36d0fa8ee9268a43a4eae54ea7bd6. The base emitted one warning for the target-only case and two for the root-and-target case; the head met the asserted counts of zero and one, respectively, and retained the job'sCAN_MANAGE_RUNpermission.bundle validate --strictacceptance run and current-head CI result are not evidenced here. The independent output review was skipped under the pilot policy.