One of the great powers of merge requests is that anyone with read access to a project can fork
it, commit
some changes to their fork and then create a merge request against the original project with
their changes.
There are some files stored in source control that are important. For example, a Jenkinsfile
may contain configuration details to sandbox merge requests in order to mitigate against
malicious merge requests.
In order to protect against a malicious merge request itself modifying the
Jenkinsfile
to remove
the protections, you can define the trust policy for merge requests from forks.
Other plugins can extend the available trust policies. The default policies are:
Jenkinsfile
) the contents of that file will be retrieved from
the
target branch on the origin project and not from the merge request branch on the fork project.
Nobody
.