Feature overview
Important to note: If you're looking to assign permissions for Salesforce orgs that are not used in team-shared CI jobs, then these permissions are configured differently.
Read below documentation on sharing org credentials with team members for guidelines on how to assign permissions for:
- CI jobs that are not converted to team-shared CI jobs
- Or permissions for org connections that are not used in team-shared CI jobs
Controlling which members can run and edit team-shared CI jobs or team-shared Pipelines is an important part of any secure large team.
In Gearset, there are two ways to assign team-shared pipeline or CI job permissions to members of your team.
Note: Team owners will always have "Admin" permission on all team-shared resources (e.g. org connections, CI jobs and Pipelines), which bestows the same level of access as the "Edit" permission, with the addition of being able to delete team-owned resources and update their permissions.
Assigning permissions for team-shared CI jobs
This step by step guide will help you manage permissions assigned to users for your team-shared CI jobs.
Navigate to Pipelines & CI jobs page, and follow these steps:
Under Team-shared Pipelines select the Pipeline that contains the CI job you want to assign permissions for.
Then scroll down to CI jobs section and select this arrow:
next to the CI job you want to assign permission for.Select Edit CI job users... button
Next, select the type of permission (e.g.
None,Validate,Run,EditorAdmin) for the user(s) that you're looking to amend the permission for (see below screenshot).And lastly, click on the blue button Save
to make sure changes are applied.
List of available CI job permissions
Below definitions of each of available permissions for team-shared CI jobs will help you understand which permission to assign to which users on your Gearset team.
None - This setting means that users cannot run the CI job or edit the job settings.
Validate - This allows users to run PR validations against the Pipeline environment (CI jobs) they have
Validateaccess for.Note: Users cannot merge validated PRs with this permission.
Run - This allows users to run the CI job. If the CI job is in a pipeline, this setting would allow users to promote the PR within the pipeline.
Edit - This allows users to edit the CI job settings, including amending metadata filter, as well as to run the job.
Admin - a team member becomes an owner of the CI job, effectively gaining "Edit" access rights for the job, and the ability to assign permissions for the job to other Gearset team members.
Note: Team members with an
Adminpermission don't get right to delete a team-shared CI job. Deletion can only be done by Team Owners.
Assigning permissions for team-shared Pipeline(s)
This step by step guide will help you manage permissions assigned to users for the team-shared Pipelines on your Gearset team.
Navigate to Pipelines & CI jobs page, and follow these steps:
Under Team-shared Pipelines, click on the right arrow button:
right next to the Pipeline you want to set permissions for.Under Users section, select Edit pipeline users...
Next, under Access column select the type of permission (e.g.
None,View,EditorAdmin) you want to assign for an existing Member on your Gearset team.Note that all Team Owners by default have an Owner access to all team-shared Pipelines, so you can't amend or downgrade this access.
Once you've assigned the necessary permission(s) to the user(s), make sure to scroll up a bit and hit
(see screenshot below). This is to ensure that your changes will saved be applied!
List of available Pipeline permissions
Levels of access for a pipeline are:
Edit - this allows users to edit details of the pipeline, including adding, removing or rearranging static environments and dev sandboxes.
View - this allows users to view the pipeline, but user cannot change any pipeline settings.
None - this setting means users cannot see the pipeline or edit any of its details.
Admin - a team member becomes an owner of the Pipeline, and they gain the ability to assign Pipelines permissions to other team members.
This permission doesn't automatically give an
Admindeployment rights for all the CI jobs within the Pipeline. It's because permissions for team-shared CI jobs used within the Pipeline are set up individually for each CI job.
Note: A team member with an
Adminaccess is also authorized to delete a Pipeline, should there ever be a need for this.
Note: Even if a user has the "None" permission assigned for pipeline, that does not stop the user from running the CI jobs within the pipeline. Ability to Run the job is controlled by individual CI job permissions.
This article also explains how to set CI job permissions later on.
"Create releases' permission
Gearset introduced a separate permission (checkbox) that allows team owners to control which user(s) can create releases in team-shared Pipelines.
To find the permission:
Navigate to Pipelines & CI job page, and select your team-shared Pipeline by clicking this button:
located next to the Pipeline name.Under Users select Edit pipeline users
You'll then see an checkbox to allow
All users with access to this pipeline can create releases(no 1 below), or to individually select users who should have access to create releases (no 2 below).
When
All users with access to this pipeline can create releasesis ticked, it means that all users on your Gearset team are allowed to create releases for that Pipeline.Therefore, you're not able to assign "Create releases" permission to individual users until this checkbox is unticked.
If the intention is to have a smaller subset of users who are allowed to create releases in this Pipeline, untick the checkbox, and in the Create releases column select individual users instead. Once done, save the changes (see video below).
Assigning multiple permissions to a member
In the My account menu, select Team management -> People -> Users (or directly through this link; similarly you can open this link to access the My Profile tab). This will present a list of all the users in your team:
Selecting a team member on this screen will display the team-shared resources they have access to:
Selecting Edit access to pipelines & CI jobs will bring you to the pipelines & CI job permission screen. Here you can set a user's permission level to Edit, Run or None for each CI job, as well as Edit, View or None for each pipeline.
In the Current pipelines & CI jobs tab you can change permissions to pipelines and CI jobs that the user already has access to. These are grouped into jobs that are part of a pipeline and those that are standalone:
In the Delegate access to other pipelines & CI jobs tab you can grant permissions to pipelines or CI jobs that the user currently has no access to. To grant a permission across many pipelines or CI jobs at once, there is a bulk assign feature as well:
Assigning permissions to multiple members
To set many user permissions on a specific pipeline or CI job, in the My account menu, select Team management -> Permissions -> Pipelines & continuous integration (CI) (or directly through this link).
This page lists team-shared pipelines, and also any CI jobs that are not connected to a pipeline in a section below.
Selecting any pipeline in the list will bring you to the permission screen of the pipeline.
This page shows user pipeline permissions and the CI jobs connected to this pipeline, and allows you to set which members can edit or view the pipeline, as well as who can run or edit the CI jobs within the pipeline.
Selecting Edit users & access for this pipeline will allow you to add members from your team using the search box, and assign them permissions to the pipeline - or alternatively you can remove any permission assigned to them.
You can expand any CI job in the list to see users' permissions on the job. Add or remove users and change their permissions for the org by selecting Edit users & access for this CI job:
