Merge branch 'improve-pipeline-visibility-desc' into 'master'

Update 'Visibility of pipelines'

Closes #34360

See merge request !13948

app/views/projects/pipelines_settings/_show.html.haml

@@ -60,8 +60,21 @@
               = f.check_box :public_builds
               %strong Public pipelines
             .help-block
-              Allow everyone to access pipelines for public and internal projects
+              Allow public access to pipelines and job details, including output logs and artifacts
               = link_to icon('question-circle'), help_page_path('user/project/pipelines/settings', anchor: 'visibility-of-pipelines'), target: '_blank'
+            .bs-callout.bs-callout-info
+              %p If enabled:
+              %ul
+                %li
+                  For public projects, anyone can view pipelines and access job details (output logs and artifacts)
+                %li
+                  For internal projects, any logged in user can view pipelines and access job details (output logs and artifacts)
+                %li
+                  For private projects, any member (guest or higher) can view pipelines and access job details (output logs and artifacts)
+              %p
+                If disabled, the access level will depend on the user's
+                permissions in the project.
+
         %hr
         .form-group
           .checkbox

doc/user/project/pipelines/settings.md

@@ -66,10 +66,30 @@ in the pipelines settings page.
 ## Visibility of pipelines
-For public and internal projects, the pipelines page can be accessed by
-anyone and those logged in respectively. If you wish to hide it so that only
-the members of the project or group have access to it, uncheck the **Public
-pipelines** checkbox and save the changes.
+Access to pipelines and job details (including output of logs and artifacts)
+is checked against your current user access level and the **Public pipelines**
+project setting.
+
+If **Public pipelines** is enabled (default):
+
+- for **public** projects, anyone can view the pipelines and access the job details
+  (output logs and artifacts)
+- for **internal** projects, any logged in user can view the pipelines
+  and access the job details
+  (output logs and artifacts)
+- for **private** projects, any member (guest or higher) can view the pipelines
+  and access the job details
+  (output logs and artifacts)
+
+If **Public pipelines** is disabled:
+
+- for **public** projects, anyone can view the pipelines, but only members
+  (reporter or higher) can access the job details (output logs and artifacts)
+- for **internal** projects, any logged in user can view the pipelines,
+  but only members (reporter or higher) can access the job details (output logs
+  and artifacts)
+- for **private** projects, only members (reporter or higher)
+  can view the pipelines and access the job details (output logs and artifacts)
 ## Auto-cancel pending pipelines