Restrict access to trigger the GitLab pipeline job

Question

I have a requirement: Only people with the Maintainer access in the repository should have access to trigger the Gitlab pipeline jobs in the respective repository. The developers in the repositories have Write access to the repository and can also trigger the GitLab pipeline jobs. I need a workaround to restrict the triggering in higher environment branches.

Answer 1

I had a requirement for a job to run manually and only select users should run the job. Below is the rule:

    - if: $CI_PIPELINE_SOURCE == "web" && $GITLAB_USER_LOGIN == "<User Name>"
      when: manual
    - when: never

Alternatively you can use GitLab API's to check user access level and run the job based on that condition (But this will be part of the script, Community version GitLab does not provide this kind of rules). Furthermore you can add rules based on branch names:

    - if: $CI_COMMIT_BRANCH == "develop" || $CI_COMMIT_BRANCH  =~ /^release/
      when: always

Answer 2

We are using protected environment and protected variables in CICD. Only mainteiners have access to them.

So anyone could trigger pipeline, but it was failed, cause there no access to k8s, and other resources