feat(gitlab): Cache results acl project membership #2280
Conversation
Summary of ChangesHello @chmouel, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a significant performance optimization for GitLab integration by implementing a caching layer for project membership checks. By storing the results of Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Pull Request Overview
This PR implements caching functionality for GitLab project membership checks to reduce redundant API calls when verifying the same user's membership status multiple times during event processing.
Key changes:
- Added a
memberCachemap to the GitLab Provider struct to cache membership results by user ID - Modified the
checkMembershipmethod to check cache first and store results for successful API calls - Implemented logic to avoid caching API failures to allow retry on transient errors
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pkg/provider/gitlab/gitlab.go | Added memberCache field to Provider struct with documentation |
| pkg/provider/gitlab/acl.go | Implemented caching logic in checkMembership method with cache initialization and result storage |
| pkg/provider/gitlab/test/test.go | Added helper function for testing caching behavior with API call counting |
| pkg/provider/gitlab/acl_test.go | Added comprehensive tests for membership caching and failure handling scenarios |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
pipelines-as-code
bot
added
enhancement
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces caching for GitLab project membership checks to reduce API calls, which is a great performance improvement. The implementation is mostly solid, with good test coverage for the happy path and for uncached failures. However, I've found a potential issue in the error handling logic where a successful fallback check during an API failure could lead to incorrect caching, preventing future API checks for that user. My review includes a suggestion to fix this.
Implemented caching in gitlab for results returned by `checkMembership`. This was done to reduce repeated calls to the GitLab API when checking the membership status of the same user multiple times during processing of an event. Co-authored-by: Claude <[email protected]> Jira: https://issues.redhat.com/browse/SRVKP-9056 Signed-off-by: Chmouel Boudjnah <[email protected]>
chmouel
force-pushed
the
SRVKP-9056-feat-gitlab-cache-results-acl-project-membership
branch
from
3e6bad3 to
af38bdb
Compare
| v.memberCache = map[int]bool{} | ||
| } | ||
|
|
||
| if allowed, ok := v.memberCache[userid]; ok { |
There was a problem hiding this comment.
@chmouel like in Konflux, what if event comes User A is member of Repository R and it is cached but same user does something for Repository B and there User A is not member or an approved user, but due to cache A will be allowed. wdyt?
There was a problem hiding this comment.
shouldn't it be mapping to repository URL
There was a problem hiding this comment.
that should not happen because it works by event not across repository tho,
What's the reason we make multiple call to check the membership multiple times when processing an event? If caching the first response works then only one call should be necessary. Reducing the call volume seems preferable, especially since the Provider object only lives for the duration of one event; it would only ever check one username FWICT |
it's basically how the code is structured.. when we check from a comment we need to do a ACL Check from the submitted sending /ok-to-test with all the logic coming if allowed from repo/org or OWNERS files, it's a bit of a recursive function |
|
I do want in the future that we do some caching via TTL of git api fetch of objects when requested via SHA since those should be immutable, we have a jira story for it.. |
| if err != nil { | ||
| // If the API call fails, fall back without caching the result so a | ||
| // transient failure can be retried on the next invocation. | ||
| isAllowed, _ := v.IsAllowedOwnersFile(ctx, event) | ||
| return isAllowed | ||
| } | ||
|
|
||
| if member.ID != 0 && member.ID == userid { | ||
| v.memberCache[userid] = true | ||
| return true | ||
| } | ||
|
|
||
| isAllowed, _ := v.IsAllowedOwnersFile(ctx, event) | ||
| v.memberCache[userid] = isAllowed |
There was a problem hiding this comment.
Small change but simplifies a bit
| if err != nil { | |
| // If the API call fails, fall back without caching the result so a | |
| // transient failure can be retried on the next invocation. | |
| isAllowed, _ := v.IsAllowedOwnersFile(ctx, event) | |
| return isAllowed | |
| } | |
| if member.ID != 0 && member.ID == userid { | |
| v.memberCache[userid] = true | |
| return true | |
| } | |
| isAllowed, _ := v.IsAllowedOwnersFile(ctx, event) | |
| v.memberCache[userid] = isAllowed | |
| member, _, apiErr := v.Client().ProjectMembers.GetInheritedProjectMember(v.targetProjectID, userid) | |
| if apiErr == nil && member.ID != 0 && member.ID == userid { | |
| v.memberCache[userid] = true | |
| return true | |
| } | |
| isAllowed, _ := v.IsAllowedOwnersFile(ctx, event) | |
| // don't cache result if GetMembership API call errored | |
| if apiErr == nil { | |
| v.memberCache[userid] = isAllowed | |
| } |
| } | ||
| } | ||
|
|
||
| func TestMembershipAPIFailureDoesNotCacheFalse(t *testing.T) { |
There was a problem hiding this comment.
Test name is slightly misleading; if the API successfully returns false, it will/should be cached (assuming the owners file check also returns false).
| func TestMembershipAPIFailureDoesNotCacheFalse(t *testing.T) { | |
| func TestMembershipAPIFailureDoesNotCacheApiError(t *testing.T) { |
| } | ||
| } | ||
|
|
||
| func TestMembershipCaching(t *testing.T) { |
There was a problem hiding this comment.
Can you also add a test to check the caching on
- user is allowed via owners file
- user is not allowed
3 participants
Implemented caching in gitlab for results returned by
checkMembership.This was done to reduce repeated calls to the GitLab API when checking
the membership status of the same user multiple times during processing
of an event.
Co-authored-by: Claude [email protected]
Signed-off-by: Chmouel Boudjnah [email protected]
📝 Description of the Change
👨🏻 Linked Jira
Jira: https://issues.redhat.com/browse/SRVKP-9056
🔗 Linked GitHub Issue
Fixes #
🚀 Type of Change
fix:)feat:)feat!:,fix!:)docs:)chore:)refactor:)enhance:)deps:)🧪 Testing Strategy
🤖 AI Assistance
If you have used AI assistance, please provide the following details:
Which LLM was used?
Extent of AI Assistance:
Important
If the majority of the code in this PR was generated by an AI, please add a
Co-authored-bytrailer to your commit message.For example:
Co-authored-by: Gemini [email protected]
Co-authored-by: ChatGPT [email protected]
Co-authored-by: Claude [email protected]
Co-authored-by: Cursor [email protected]
Co-authored-by: Copilot [email protected]
**💡You can use the script
./hack/add-llm-coauthor.shto automatically addthese co-author trailers to your commits.
✅ Submitter Checklist
fix:,feat:) matches the "Type of Change" I selected above.make testandmake lintlocally to check for and fix anyissues. For an efficient workflow, I have considered installing
pre-commit and running
pre-commit installtoautomate these checks.