GitLab CI流水线权限隔离

方案概述

本方案实现在GitLab CI/CD中根据不同人员的权限级别执行不同的流水线步骤，主要基于GitLab的以下特性：

• rules 条件判断
• variables 变量传递
• only/except 条件限制
• 用户权限API查询

  基础权限模型设计

  1. 用户角色定义

  角色	描述	对应GitLab权限
  Developer	普通开发人员	Developer
  Maintainer	项目维护者	Maintainer
  Owner	项目所有者	Owner
  Auditor	审计人员	Reporter

  2. 权限与流水线阶段对应关系

  流水线阶段	Developer	Maintainer	Owner	Auditor
  build	✓	✓	✓	✓
  test	✓	✓	✓	✓
  staging	✗	✓	✓	✓
  production	✗	✗	✓	✗
  audit	✗	✗	✗	✓

  实现方案

  1. 基于分支保护的方案

  stages:
    - build
    - test
    - staging
    - production
    - audit
  build:
    stage: build
    script: echo "Building..."
    rules:
      - if: '$CI_PIPELINE_SOURCE == "push"'
  test:
    stage: test
    script: echo "Testing..."
    rules:
      - if: '$CI_PIPELINE_SOURCE == "push"'
  staging:
    stage: staging
    script: echo "Deploying to staging..."
    rules:
      - if: '$CI_COMMITTER_ACCESS_LEVEL >= 40' # Maintainer及以上
      - if: '$CI_DEPLOY_USER_ACCESS_LEVEL >= 40'
  production:
    stage: production
    script: echo "Deploying to production..."
    rules:
      - if: '$CI_COMMITTER_ACCESS_LEVEL == 50' # Only Owner
      - if: '$CI_DEPLOY_USER_ACCESS_LEVEL == 50'
  audit:
    stage: audit
    script: echo "Running audit..."
    rules:
      - if: '$CI_COMMITTER_ACCESS_LEVEL == 20' # Reporter
      - if: '$CI_DEPLOY_USER_ACCESS_LEVEL == 20'
  

  2. 基于自定义变量的方案（更灵活）

  variables:
    # 通过API获取用户权限级别
    USER_ACCESS_LEVEL: $(
      curl --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" \
      "$CI_API_V4_URL/projects/$CI_PROJECT_ID/members/$GITLAB_USER_ID" | \
      jq '.access_level'
    )
  stages:
    - build
    - test
    - staging
    - production
    - audit
  .job_template: &job_settings
    interruptible: true
    tags:
      - docker
  build: