Cannot apply custom label: "is restricted"

[Paul Jolly]

Hi all,

I've followed the documentation at:

https://gerrit-review.googlesource.com/Documentation/config-labels.html

to define a custom label as follows:

[access "refs/for/refs/*"]

label-Code-Review = -2..+2 group Approvers

label-TryBot-Result = -1..+1 group Approvers

...     

[label "TryBot-Result"]

function = NoBlock

value = -1 Fail

value = 0 No score

value = +1 Pass

defaultValue = 0

The custom label appears on changes in the web UI (although there doesn't appear to be a way of setting a value for the label, even when logged in as a valid user).

But when I come to try and apply that label via a REST API call, I get the error message:

"Applying label "TryBot-Result": 1 is restricted"

That same user can successfully apply the Code-Review label, just not my custom label.

I've had what I would consider a good Google on this subject, but not made any progress towards the answer.

Please can someone help point me in the right direction? Where is this restriction defined/configured? Or am I holding this entirely wrong?

If it is relevant, the project I am looking to configure is on gerrithub.io.

Many thanks

Paul

[Paul Jolly]

I've made some progress on this thanks to https://stackoverflow.com/questions/25478344/adding-gerrit-label-but-not-able-to-see-it-properly-in-review-page/25479882#25479882

Adding the following:

[access "refs/heads/*"]

...

label-TryBot-Result = -1..+1 group Approvers

worked. i.e. my approver account could modify the label via REST or the UI.

What I'm not clear is why that setting needs to be under "refs/heads/*" - and indeed how I should have known this from the documentation.

[Matthias Sohn]

On Thu, May 13, 2021 at 2:07 PM Paul Jolly <pa...@myitcv.org.uk> wrote:

I've made some progress on this thanks to https://stackoverflow.com/questions/25478344/adding-gerrit-label-but-not-able-to-see-it-properly-in-review-page/25479882#25479882

Adding the following:

[access "refs/heads/*"]

...

label-TryBot-Result = -1..+1 group Approvers

worked. i.e. my approver account could modify the label via REST or the UI.

What I'm not clear is why that setting needs to be under "refs/heads/*" - and indeed how I should have known this from the documentation.

I think that's documented here [1].

And the documentation explaining how to define custom labels has some more examples [2].

If you think it's not sufficiently described let us know how we could improve the documentation.

[1] https://gerrit-review.googlesource.com/Documentation/access-control.html#_project_access_control_lists

[2] https://gerrit-review.googlesource.com/Documentation/config-labels.html

 

-Matthias

[Paul Jolly]

> I think that's documented here [1].
> And the documentation explaining how to define custom labels has some more examples [2].
> If you think it's not sufficiently described let us know how we could improve the documentation.
>
> [1] https://gerrit-review.googlesource.com/Documentation/access-control.html#_project_access_control_lists
> [2] https://gerrit-review.googlesource.com/Documentation/config-labels.html

I just re-read the documentation for "label.Label-Name.branch"
(incidentally, it would be nice to be able to link to those sub
headings with anchor links) and it now makes total sense. I
misinterpreted/misunderstood that documentation the first time around.

Thank you for prompting me to re-read that.


Paul