[Archive] Adding and removing a Subsystem or Topic maintainer

Using the GitLab UI for these tasks is no longer needed. This page is kept for reference only.

Instead, use Add or remove a Subsystem or Topic maintainer

Initial setup

1. In GitLab as a user with the Maintainer permissions (this is currently any approved core committer) navigate to Settings > Repository.

   

2. Expand Protected Branches and click “Add a new protected branch".

   

3. Set the branch name to *.
   Ensure “Create wildcard *” is used for the Branch name.

   

   Set Allowed to Merge to “Maintainers”.
   Set Allowed to push and merge to “Maintainers”.

   The remaining values should be set to disabled in order to keep the repository operating as close to as it has been operated to date.  A followup issue may be created by the Core Committers to enforce a stricter policy upon themselves going forward.

4. The final result should look as follows.

   

   While maintainers have historically had the permission to force push, D.O. Hooks have prevented this as all D.O. branches present have an open release in them. Force push can be enabled if deemed useful without impacting the end result of restricting subsystem maintainers. Changing this option will not overriding existing commit hooks.

5. Click the Protect button.

6. Navigate to Protected tags and click Add Tag.

   

7. Set the tag name to “*”.
   Ensure Create wildcard * is selected.

   
   Set “Allowed to create” to “Maintainers”.

8.  The final version should looks as below.

   

9. Click the Protect button.

Only users with the Maintainers role may now push/delete/merge code or create/delete tags.

Onboarding a Subsystem Maintainer

Two options are currently available depending upon what the Drupal Core team decides to utilize.

Using the Drupal.org Maintainers UI

The first option is using the D.O. Users UI. Users will be listed on the D.O. project page.

1. As a user with the role “Administer maintainers” in the Drupal Core project navigate to https://www.drupal.org/project/drupal and click “Maintainers”.

   

2. Add a new user (or select an existing user) and check the permission for “Write to VCS”

   

   While D.O. wording currently indicates this user will be allowed to commit code, unless they are granted the Administer maintainers role they will be added to GttLab with the Developer role. The developer role has been restricted from committing code in the Setup phase of this documentation.

3. Save the user update.

   

The User will now be a Developer in GitLab.

Using the GitLab User Management UI

Users added using only this method may not appear on the Drupal.org project page.

1. Open the project in GitLab and navigate to Manage > Members.

   

2. Click Invite Members.

   

3. Fill out the form inviting subsystem maintainers as needed.
   Ensure the role is Developer.

   

4. Select Invite.

The user now has the developer role. The Developer role has been restricted from committing code in the Setup phase of this documentation.

This is also used when a Subsystem Maintainer becomes a provisional core committer.

1. If not already done follow the steps in “Onboarding a Subsystem maintainer“.

2. Navigate to Settings > Repository in GitLab.

3. Expand out Protected Branches.

4. If adding the user to an existing branch match (such as * ) start process A, otherwise proceed to process B.

Process A: Add the user to an existing branch match

1. Locating the existing branch tag and under Allowed to merge and Allowed to push and merge search for the new provisional committer.

   

2. The final should look similar to the following.

   

   It is saved automatically.

Process B: Limiting the new committer to a branch tag that does not currently exist

1. Add a new Protected Branch. 

2. Search for the new Provisional committer in the  “Allowed to merge” and “Allowed to push and merge” windows.

   

   Disable all other options. The core team can consider changing this policy at a future date.

3. The final page should appear similar to the following.

   

4. Click Protect

The user now has the ability to commit/merge code to the appropriate branches without being granted the ability to manage project settings or add additional users.

Upgrading a provisional Maintainer to a full committer 

Using the Drupal.org Maintainers UI

1. As a user with the role “Administer maintainers” in the Drupal Core project navigate to https://www.drupal.org/project/drupal and click “Maintainers”.

2. Locate (or add) the new Provisional maintainer with at least the Write to VCS and  Administer Maintainers roles.

   

   These roles will (currently) grant the user the Maintainer role in GitLab.

3. Open the project in GitLab and navigate to Settings > Repository.

   

4. Navigate to Protected Branches and locate the branch restriction with the Maintainer.

   

5. Click to deselect the account on both “Allowed to merge” and  “allowed to push and merge”.

6. A save is not required, the change will take effect immediately.

The user is now a maintainer and the manual additional of commit privileges has been removed.

Using the GitLab UI

1. Open the project in GitLab and navigate to Manage > members.

   

2. Locate the Subsystem Maintainer account and choose “Maintainer”.

   

3. Navigate to Settings > Repository.

   

4. Navigate to Protected Branches and locate the branch restriction with the Maintainer.

   

5. Click to deselect the account on both “Allowed to merge” and  “allowed to push and merge”.

6. A save is not required, the change will take effect immediately.

The user is now a maintainer and the manual addition of commit privileges has been removed.

Deleting tags as a full Maintainer

When protected tags are enabled the ability to delete tags via GIT Push is disabled in GitLab. A maintainer may still delete tags however it must be done via the GitLab UI or API.

1. Open the project in GitLab and navigate to Code > Tags.

   

2. Locate the tag you desire to delete and click​​​​​​​.

   

3. A popup window will ask you to confirm deleting the protected tag. Follow the instructions and click “Yes, delete protected tag”.

   

The tag will be deleted and a new version can be submitted.