Retried jobs not associated with a source project

Some time ago we introduced a Ci::RetryBuildService. It appears that source_project / target_project mismatch strikes again, and when someone retries build from a fork in context of a target project, a newly created build is associated with a target project instead of a source project.

This happens in a retry service:

      Ci::Build.transaction do
        # mark all other builds of that name as retried
        build.pipeline.builds.latest
          .where(name: build.name)
          .update_all(retried: true)

        project.builds.create!(Hash[attributes])
      end

Project we should create a build should be a source project, but project inside a service is always a project that we view pipelines in, here it is a target project.

This might be a security issue.

We should fix this problem and resolve it once and for all, maybe by implementing pipelines for merge requests https://gitlab.com/gitlab-org/gitlab-ce/issues/23902.

Originally reported in https://gitlab.com/gitlab-org/gitlab-ce/issues/35109.

/cc @ayufan @nick.thomas @briann

changed the description

Maybe I was confused because we create a service object using a source project:

      def retry(build, current_user)
        Ci::RetryBuildService
          .new(build.project, current_user)
          .execute(build)
      end

However in @nick.thomas' pipeline https://gitlab.com/nick.thomas/gitlab-ce/pipelines/9865140/builds retried jobs are not associated with a correct project.

It still needs some investigation.

added needs investigation label

changed milestone to %9.4

Okay, I know what happened, and we are actually fine. Builds are not associated with a wrong project, I was confused by looking at too much links gitlab-ce.

closed

made the issue visible to everyone

Phew!

It's been one of those weeks.