Skip to content

Edit inherited membership for protected environment deploy groups #658

Closed

Description

@sjungwon03

Problem

Approval-group membership is editable, but existing group-based deploy grants
cannot switch between direct-only and inherited membership in LabFox.

Scope

Edit only group_inheritance_type (0 or 1) on one existing project protected-
environment deploy grant with positive stable grant/group IDs, no user selector,
and an explicitly reported current membership value. Preserve any reported role
metadata, group identity, every other deploy grant, approval rule and legacy
approval count. Group-level environment rules and unknown membership remain
read-only. No grant creation/removal or group/role conversion in this slice.

Require selection, a changed value, exact environment name and acknowledgement.
Explain that including inherited members expands deploy eligibility and narrowing
membership can remove deployment access. Scan the complete inventory and strictly
read the complete rule before confirmation and again before dispatch.

Send one non-replayed/non-redirected PUT containing only the deploy grant ID and
membership value. Strict response and authoritative read-back must match the
snapshot with only the selected value changed. Uncertainty requires read-only
inspection and renewed confirmation; session replacement and overlap are isolated.

Validation

Test first: exact encoded body, status/malformed failures, no OAuth replay,
pagination, stale/ambiguous/unchanged/unknown targets, preservation, uncertainty,
account replacement, five locales, three widths, light/dark. Run all local quality
gates and add synthetic screenshots and MW-02 evidence.

Reference and limits

https://docs.gitlab.com/api/protected_environments/#group-inheritance-types
https://docs.gitlab.com/api/protected_environments/#update-a-protected-environment

Premium/Ultimate, project CI/CD, management permissions and project sharing with
the group remain server requirements. No atomic compare-and-set, live eligibility
inference or live role/tier/version validation is claimed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions