4 ms·

I cannot find if project-scoped access tokens (which was a Bronze+ feature) are available in the Free tier, or whether they require Silver. It's such a glaring

by jeswin 6y ago

I cannot find if project-scoped access tokens (which was a Bronze+ feature) are available in the Free tier, or whether they require Silver. It's such a glaring omission on GitHub - which only has personal access tokens which give apps full access to all your repos.

0x008 6y ago
So they give full access to all repos you have access to (I.e. organizational repos) or only the ones you own? If so this would mean I would consider to moving to a platform where the repository owner can control the tokens.
leipert 6y ago
GitLab employee here. Just asked the Product Manager responsible. Project Access Tokens [0] will be available on Premium for GitLab.com and available on Free for self-hosted. [0]: https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html https://docs.gitlab.com/ee/user/project/settings/project_acc...
- Aeolun 6y ago
  I thought you were going to make the layers easier to understand? :P Different features at different levels between self-hosted and gitlab.com seem counterproductive in that regard.
  - leipert 6y ago
    Certain features are disabled on GitLab.com in order to prevent abuse, are difficult to scale or just make no sense. In the case of the Project Access Tokens, the feature is quite new and it is to prevent abuse. See also the (nephew/niece?) comment I made in the thread (one to the side from yours, one down)
- TavsiE9s 6y ago
  But not in the CE?
  - leipert 6y ago
    Not working on the feature, but it seems to be available in CE. We disable it for GitLab.com because the feature has some potential to be abused: - CE: https://gitlab.com/gitlab-org/gitlab/-/blob/d0b75f214f67345c7c733d43c40698d24b83f9db/app/policies/project_policy.rb#L701-703 https://gitlab.com/gitlab-org/gitlab/-/blob/d0b75f214f67345c... - EE: https://gitlab.com/gitlab-org/gitlab/-/blob/d0b75f214f67345c7c733d43c40698d24b83f9db/ee/app/policies/ee/project_policy.rb#L405-414 https://gitlab.com/gitlab-org/gitlab/-/blob/d0b75f214f67345c... (I think Project Access Tokens create bot users under the hood that are associated with the token. So if one were to create hundreds of tokens that means hundreds of users.)
    - TavsiE9s 6y ago
      Thanks!
mdaniel 6y ago
> I cannot find if project-scoped access tokens (which was a Bronze+ feature) are available in the Free tier, or whether they require Silver. The manual says "Bronze and above" for gitlab.com https://docs.gitlab.com/ce/user/project/settings/project_access_tokens.html#project-access-tokens https://docs.gitlab.com/ce/user/project/settings/project_acc... but I tried the open-source "CE" docker container earlier this week and found that they worked there (maybe that's what "Core" means?)

by jeswin 6y ago

0x008 6y ago

So they give full access to all repos you have access to (I.e. organizational repos) or only the ones you own? If so this would mean I would consider to moving to a platform where the repository owner can control the tokens.

leipert 6y ago

GitLab employee here. Just asked the Product Manager responsible. Project Access Tokens [0] will be available on Premium for GitLab.com and available on Free for self-hosted. [0]: https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html https://docs.gitlab.com/ee/user/project/settings/project_acc...

Aeolun 6y ago
I thought you were going to make the layers easier to understand? :P Different features at different levels between self-hosted and gitlab.com seem counterproductive in that regard.
- leipert 6y ago
  Certain features are disabled on GitLab.com in order to prevent abuse, are difficult to scale or just make no sense. In the case of the Project Access Tokens, the feature is quite new and it is to prevent abuse. See also the (nephew/niece?) comment I made in the thread (one to the side from yours, one down)
TavsiE9s 6y ago
But not in the CE?
- leipert 6y ago
  Not working on the feature, but it seems to be available in CE. We disable it for GitLab.com because the feature has some potential to be abused: - CE: https://gitlab.com/gitlab-org/gitlab/-/blob/d0b75f214f67345c7c733d43c40698d24b83f9db/app/policies/project_policy.rb#L701-703 https://gitlab.com/gitlab-org/gitlab/-/blob/d0b75f214f67345c... - EE: https://gitlab.com/gitlab-org/gitlab/-/blob/d0b75f214f67345c7c733d43c40698d24b83f9db/ee/app/policies/ee/project_policy.rb#L405-414 https://gitlab.com/gitlab-org/gitlab/-/blob/d0b75f214f67345c... (I think Project Access Tokens create bot users under the hood that are associated with the token. So if one were to create hundreds of tokens that means hundreds of users.)
  - TavsiE9s 6y ago
    Thanks!

mdaniel 6y ago

> I cannot find if project-scoped access tokens (which was a Bronze+ feature) are available in the Free tier, or whether they require Silver. The manual says "Bronze and above" for gitlab.com https://docs.gitlab.com/ce/user/project/settings/project_access_tokens.html#project-access-tokens https://docs.gitlab.com/ce/user/project/settings/project_acc... but I tried the open-source "CE" docker container earlier this week and found that they worked there (maybe that's what "Core" means?)