|author||Luca Milanesio <firstname.lastname@example.org>||Sat Oct 02 00:31:16 2021 +0100|
|committer||Luca Milanesio <email@example.com>||Thu Oct 14 20:35:19 2021 +0100|
Avoid looking up refs for all filtered changes When filtering a huge list of refs all the closed changes need to be identified and hidden; however, the mere lookup of the changes' SHA1s from the repository's ref-database can cause a considerable system load because of the high number of change refs. The initial list of refs to be filtered contains already all the '/meta' refs and their associated SHA1s hence it can be reused for looking up the change-id to their latest version instead of re-reading the same information from the repository on disk. Depends-On: https://gerrit-review.googlesource.com/c/gerrit/+/319756 Change-Id: I164addd6abc7c1dff1cfeedcec27415e6b88f3b3
Gerrit lib module to allow filtering out refs in the Git advertizing protocol phase.
Gerrit ACLs, Git's hideRefs and git-refs-filter are all tools for hiding refs from being visible to a remote Git client. However, the three tools have different scope and performance implications.
Use the Git's hideRefs when all Git clients need to be blocked from accessing some refs.
This method to hide refs is the fastest possible and has no performance implications.
The git-refs-filter is mostly used with CI systems to avoid the overloading of advertising and downloading a significant number of refs that would slowdown both Gerrit server and the Git client.
It is more flexible than Git‘s hideRefs because allows to define a limited group of users for hiding refs; it also allows to filter Gerrit NoteDb’s
/meta refs which would otherwise require a complex set of ACLs or plugins.
git-refs-filter is slightly slower than using Git's hideRefs and it does require the configuration of the change_notes cache in
gerrit.config to avoid potentially high overhead.
Use the Gerrit ACLs when you need to hide some of the refs on a per-project basis or when it is needed a very sophisticated pattern-matching of refs to be excluded.
This is the slowest way to hide refs and needs to be used only when a per-project ACLs policy is required.
Build this module as it was a Gerrit plugin:
git-refs-filterdirectory to Gerrit
bazel build plugins/git-refs-filter
bazel test plugins/git-refs-filter:git_refs_filter_tests
git-refs-filter.jarmodule is generated under
git-refs-filter.jar library to Gerrit
/lib and add the following one extra settings to
[gerrit] installModule = com.googlesource.gerrit.modules.gitrefsfilter.RefsFilterModule
The refsfilter module defines a new global capability called “Filter out closed changes refs”. By default the capability isn't assigned to any user or group, thus the module installation has no side effects.
Filtering a closed change refs has the following meaning:
It is also possible to define additional refs prefixes to be hidden or explicitly shown, using a similar syntax to the hideRefs setting, adding a set of
git-refs-filter.hideRefs configuration settings in
Example of how to hide all
refs/sandbox/* from being advertised but still show
[git-refs-filter] hideRefs = refs/backup/ hideRefs = refs/sandbox/ hideRefs = !refs/sandbox/mine/ ``` To enable a group of users of getting a "filtered list" of refs (e.g. CI jobs): - Define a new group of users (e.g. Builders) - Add a user to that group (e.g. Add 'jenkins' to the Builders group) - Go to the All-Projects ACLs, add the "Filter out closed changes refs" and assign to the group (e.g. Builders) *NOTE* Gerrit makes a super-simplified ACL evaluation if all the projects are globally readable (e.g. project has a READ rule to refs/*). To enable the closed changes filtering you need to disable any global read rule for the group that needs refs filtering.