Adds tracking events for CI Job Token Allowlist Autopopulation

app/graphql/mutations/ci/job_token_scope/autopopulate_allowlist.rb

@@ -7,6 +7,7 @@ class AutopopulateAllowlist < BaseMutation
         graphql_name 'CiJobTokenScopeAutopopulateAllowlist'
 
         include FindsProject
+        include Gitlab::InternalEventsTracking
 
         authorize :admin_project
 
@@ -22,6 +23,15 @@ class AutopopulateAllowlist < BaseMutation
         def resolve(project_path:)
           project = authorized_find!(project_path)
 
+          track_internal_event(
+            'ci_job_token_autopopulate_allowlist',
+            user: current_user,
+            project: project,
+            additional_properties: {
+              label: 'ui'
+            }
+          )
+
           result = ::Ci::JobToken::ClearAutopopulatedAllowlistService.new(project, current_user).execute
           result = ::Ci::JobToken::AutopopulateAllowlistService.new(project, current_user).execute if result.success?
 

app/models/ci/job_token/allowlist_migration_task.rb

@@ -4,6 +4,7 @@ module Ci
   module JobToken
     class AllowlistMigrationTask
       include Gitlab::Utils::StrongMemoize
+      include Gitlab::InternalEventsTracking
 
       attr_reader :only_ids, :exclude_ids
 
@@ -77,6 +78,14 @@ def log_error(project, message)
       end
 
       def perform_migration!(project)
+        track_internal_event(
+          'ci_job_token_autopopulate_allowlist',
+          user: @user,
+          project: project,
+          additional_properties: {
+            label: 'rake'
+          }
+        )
         ::Ci::JobToken::AutopopulateAllowlistService # rubocop:disable CodeReuse/ServiceClass -- This class is not an ActiveRecord model
           .new(project, @user)
           .unsafe_execute!

config/events/ci_job_token_autopopulate_allowlist.yml

+---
+description: Tracks when the CI JobToken Allowlist Autopopulation action is performed for a project
+internal_events: true
+action: ci_job_token_autopopulate_allowlist
+identifiers:
+- project
+- namespace
+- user
+additional_properties:
+  label:
+    description: The method of execution, e.g. UI or rake task
+product_group: pipeline_security
+product_categories:
+- secrets_management
+milestone: '17.10'
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/182635
+tiers:
+- free
+- premium
+- ultimate

config/metrics/counts_all/count_total_allowlist_autopopulation.yml

+---
+key_path: counts.count_total_allowlist_autopopulation
+description: Count of times the CI JobToken Allowlist Autopopulation action has been performed
+product_group: pipeline_security
+product_categories:
+- secrets_management
+performance_indicator_type: []
+value_type: number
+status: active
+milestone: '17.10'
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/182635
+time_frame:
+- 28d
+- 7d
+- all
+data_source: internal_events
+data_category: optional
+tiers:
+- free
+- premium
+- ultimate
+events:
+- name: ci_job_token_autopopulate_allowlist

spec/graphql/mutations/ci/job_token_scope/autopopulate_allowlist_spec.rb

@@ -49,6 +49,23 @@
           end.to change { Ci::JobToken::ProjectScopeLink.count }.by(1)
         end
 
+        it 'triggers the tracking events' do
+          expect do
+            resolver
+          end
+          .to trigger_internal_events('ci_job_token_autopopulate_allowlist')
+          .with(
+            user: current_user,
+            project: project,
+            additional_properties: {
+              label: 'ui'
+            }
+          ).exactly(:once)
+          .and increment_usage_metrics(
+            'counts.count_total_allowlist_autopopulation'
+          ).by(1)
+        end
+
         context 'when the clear service returns an error' do
           let(:service) { instance_double(::Ci::JobToken::ClearAutopopulatedAllowlistService) }
 

spec/models/ci/job_token/allowlist_migration_task_spec.rb

@@ -79,6 +79,7 @@
         messages << "Migration complete."
 
         task.execute
+
         messages.each do |message|
           expect(output_stream.string).to include(message)
         end
@@ -86,6 +87,39 @@
         expect(output_stream.string).not_to include("project id(s) failed to migrate:")
       end
 
+      it 'triggers the tracking events' do
+        expect do
+          task.execute
+        end
+        .to trigger_internal_events('ci_job_token_autopopulate_allowlist')
+        .with(
+          user: user,
+          project: accessed_projects[0],
+          additional_properties: {
+            label: 'rake'
+          }
+        ).exactly(:once)
+        .and trigger_internal_events('ci_job_token_autopopulate_allowlist')
+        .with(
+          user: user,
+          project: accessed_projects[1],
+          additional_properties: {
+            label: 'rake'
+          }
+        ).exactly(:once)
+        .and trigger_internal_events('ci_job_token_autopopulate_allowlist')
+        .with(
+          user: user,
+          project: accessed_projects[2],
+          additional_properties: {
+            label: 'rake'
+          }
+        ).exactly(:once)
+        .and increment_usage_metrics(
+          'counts.count_total_allowlist_autopopulation'
+        ).by(3)
+      end
+
       context "when a handled exception is raised" do
         let(:project) { create(:project) }
         let(:only_ids) { project.id.to_s }