last_commit_id ignored in commit API

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Work on this issue
• Close this issue

The GitLab REST API supports the field last_commit_id in commit actions 1. Apparently, this field is ignored. The endpoint happily creates commits even when a wrong last_commit_id is provided.

Example:

{
  "branch": "test",
  "commit_message": "test commit",
  "actions": [
    {
      "action": "update",
      "file_path": "config.yaml",
      "content": "new content",
      "encoding": "text",
      "last_commit_id": "6666666666666666666666666666666666666666"
    }
  ]
}

I'm using GitLab Community Edition v16.6.5.

Investigation (by @vyaklushin)

last_commit_id is provided to ensure that the update is applied to the latest version of the code.

We used to verify it by comparing latest version with a last_commit_id value from the user. But !113623 (merged) slightly changed the behavior. Now we also verify that the repository contains the last_commit_id. If the last_commit_id is missing in the repository, then the commit process doesn't fail anymore.

I think we should return an failure if the commit is missing and verify with groupide that it doesn't break anything on their end.