[ReenigneArcher]

Description

GitLab copies of LizardByte-infrastructure repositories can contain upstream .gitlab-ci.yml files. Mirror pushes were starting pipelines and consuming shared runner compute minutes.

Infrastructure targets now carry a CI policy that disables CI/CD (builds_access_level: disabled), instance runners, group runners, and Auto DevOps. Existing verified mirrors are updated during preparation, and updates already applied are skipped. New projects receive the settings in their creation payload before server-side imports can run. Delivery verifies the policy again before pushing, and fails if GitLab rejects or ignores any setting.

The policy applies only to GitLab copies of repositories owned by LizardByte-infrastructure. Git history and mirrored source files are retained. Existing running jobs are not canceled by this change and must be canceled separately.

Screenshot

Issues Fixed or Closed

Roadmap Issues

Testing

node --test: 229 tests passed, including 34 focused mirror/request tests. New regression coverage checks organization selection, updates to existing mirrors, combined private visibility and CI settings, rejected or partially applied settings, redundant-update avoidance, preservation of other orgs' settings, and CI enforcement before project transfers.

The actual shell jq expressions passed four creation/import payload cases and seven verification cases. ShellCheck 0.11.0, Bash syntax validation, and git diff --check passed.

GitLab mutations are mocked. Live GitLab settings were not changed while preparing this PR; the policy is applied by the next mirror run after merge. SonarCloud Code Analysis and GitHub's SonarCloud code-scanning check passed on this PR head. The remaining GitHub Actions checks are queued.

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Tests have been added or updated for new or modified functionality, including regression tests for bug fixes

AI Usage

See our AI usage policy.

• AI tools were used while preparing this PR

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud