4.1 KiB
| stage | group | info |
|---|---|---|
| Create | Code Review | To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments |
Merge requests for confidential issues
Introduced in GitLab 12.1.
Merge requests in a public repository are also public, even when the merge request is created for a confidential issue. To avoid leaking confidential information when working on a confidential issue, create your merge request from a private fork in the same namespace.
Roles are inherited from parent groups. If you create your private fork in the same namespace (same group or subgroup) as the original (public) repository, developers receive the same permissions in your fork. This inheritance ensures:
- Developer users have the needed permissions to view confidential issues and resolve them.
- You do not need grant individual users access to your fork.
The security practices for confidential merge requests at GitLab are available to read.
Create a confidential merge request
Branches are public by default. To protect the confidentiality of your work, you must create your branches and merge requests in the same namespace, but downstream in a private fork. If you create your private fork in the same namespace as the public repository, your fork inherits the permissions of the upstream public repository. Users with the Developer role in the upstream public repository inherit those upstream permissions in your downstream private fork without action by you. These users can immediately push code to branches in your private fork to help fix the confidential issue.
WARNING: Your private fork may expose confidential information, if you create it in a different namespace than the upstream repository. The two namespaces may not contain the same users.
Prerequisites:
- You have the Owner or Maintainer role in the public repository, as you need one of these roles to create a subgroup.
- You have forked the public repository.
- Your fork has a Visibility level of Private.
To create a confidential merge request:
- Go to the confidential issue's page. Scroll below the issue description and select Create confidential merge request.
- Select the item that meets your needs:
- To create both a branch and a merge request, select Create confidential merge request and branch. Your merge request will target the default branch of your fork, not the default branch of the public upstream project.
- To create only a branch, select Create branch.
- Select a Project to use. These projects have merge requests enabled, and you have the Developer role (or greater) in them.
- Provide a Branch name, and select a Source (branch or tag). GitLab checks whether these branches are available in your private fork, because both branches must be available in your selected fork.
- Select Create.
This merge request targets your private fork, not the public upstream project. Your branch, merge requests, and commits remain in your private fork. This prevents prematurely revealing confidential information.
Open a merge request from your fork to the upstream repository when:
- You are satisfied the problem is resolved in your private fork.
- You are ready to make the confidential commits public.