GitLab: Alternative approach to cml-send-comment and cml-publish

[tmaier]

• CML currently posts its results as a comment to a merge request

This raises multiple concerns

• One user must expose a PRIVATE_TOKEN as secret variable in the project. There is the danger of leaking the credentials and thus, access rights
• cml-publish stores images on an external server, which is again a security validation in certain scenarios. (see Self-host https://assets.cml.dev #291)

Proposed solution

• Embed the images as base64 encoded string in Markdown instead of uploading them to an external server
• Create an HTML report from the markdown report
• Store the HTML report as GitLab CI artifact
• Use the artifacts:expose_as feature to expose it in the the Merge Request UI with a proper name

[DavidGOrtega]

@tmaier this proposal is for GL mostly right?

The thing is that we have to provide the same API for any scm vendor. base64 images idea its not supported in GH however I like the idea of offering a base64 output in cml-publish for other vendors. We might see the viability and scm limits with this approach.

One user must expose a PRIVATE_TOKEN as secret variable in the project. There is the danger of leaking the credentials and thus, access rights

I don't see the issue here, its a secret inside your scm. They already know it and there is not way to retrieve it because its a secret.

[clamydo]

An additional base64 option wouldn't hurt scm agnosticism, so I do not see a downside. Or to put it differently, I like the idea 👍

This could partly also solve the issues with proxies #336, or if I am not allowed to share pictures/plots with external providers.

[clamydo]

For people navigating here through search, I'd like to point out the now possibility to use Gitlabs Artifact system within CML with something like

vl2png vega.json | cml-publish --md --gitlab-uploads >> report.md

or rather

vl2png vega.json | cml-publish --md --native >> report.md

[dacbd]

I feel this is closable? If not let's reopen with a clear change that needs to happen? @iterative/cml

[casperdcl]

seems to be closable in favour of #291