From 9f485bc36c6e56c2fff0968ab80c234a3c7f6c75 Mon Sep 17 00:00:00 2001 From: Florian Engelhardt Date: Mon, 27 Jul 2026 16:13:29 +0200 Subject: [PATCH] Document branch CI image build requirements --- .gitlab-ci.yml | 6 ++++++ .gitlab/generate-ci-images.php | 4 ++++ dockerfiles/ci/README.md | 10 ++++++++++ 3 files changed, 20 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 6a570f099a..f23e7bbeac 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -94,6 +94,12 @@ appsec-trigger: # Manual maintenance pipeline that (re)builds the CI Docker images. Generated # from dockerfiles/ci/*/docker-compose.yml + .env so versions live in one place. # No strategy: depend — the parent must not wait on these manual jobs. +# +# This job MUST remain available on development branches: image changes are +# built and validated from their branch before merge. Do not restrict it with +# CI_COMMIT_REF_PROTECTED or CI_DEFAULT_BRANCH. This pipeline runs only in the +# private Datadog GitLab; external pull requests cannot trigger it. Access to +# manual jobs is controlled by that GitLab project's membership and settings. ci-images: stage: ci-build rules: diff --git a/.gitlab/generate-ci-images.php b/.gitlab/generate-ci-images.php index 0b1ca5cd63..475d886c33 100644 --- a/.gitlab/generate-ci-images.php +++ b/.gitlab/generate-ci-images.php @@ -107,6 +107,10 @@ function parse_compose(string $path, array $env): array variables: CI_REGISTRY_IMAGE: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci" +# These manual jobs intentionally run on development branches so image changes +# can be built and validated before merge. Do not add protected/default-branch +# rules here. The parent pipeline is private to Datadog GitLab, where project +# membership and settings control who can run manual jobs. .linux_image_build: stage: ci-build rules: diff --git a/dockerfiles/ci/README.md b/dockerfiles/ci/README.md index 2fe59cdbff..8daa3872a8 100644 --- a/dockerfiles/ci/README.md +++ b/dockerfiles/ci/README.md @@ -45,6 +45,16 @@ repo. This is the preferred way of building the images. +> [!IMPORTANT] +> Image jobs are intentionally available from development branches. Maintainers +> must be able to build and validate an image change before merging it, so do +> not restrict `ci-images` or its generated jobs with +> `CI_COMMIT_REF_PROTECTED` or `CI_DEFAULT_BRANCH`. The pipeline runs only in +> Datadog's private GitLab: external pull requests cannot trigger it, and +> access to its manual jobs is governed by the GitLab project's membership and +> settings. A protected-ref rule identifies the ref, not whether the person +> starting a manual job has the Maintainer role. + In your pipeline ([GitLab-CI](https://gitlab.ddbuild.io/DataDog/apm-reliability/dd-trace-php/-/pipelines)), manually start the `ci-images` job (stage `ci-build`) to spawn the child