File-based group export sub-group always imports as private

Overview

When using the file based export-import to migrate groups they make contain sub-groups.

These groups, by design, import with the following visibility

Imported groups are given a private visibility level, unless imported into a parent group. If imported into a parent group, a subgroup inherits the same level of visibility unless otherwise restricted.

whether this logic is expected is a different topic and probably deserves a separate issue if incorrect. E.g. because the visibility should, if possible, remain the same or stricter between source and destination GitLab instance.

However, sub-group(s), which are part of an exported parent group, always import as private, regardless of the source visibility, destination parent group and instance level visibility restrictions. This behavior is neither expected nor documented.

If imported into a parent group, a subgroup inherits the same level of visibility unless otherwise restricted.

Note: Quotes come from doc/user/group/import/index.md, that should be adjusted with changes done for this issue.

Behavior - current

When a top-level private group is exported and imported to an internal parent group the imported group becomes internal while the sub-group remains private.

Changing the default group and project visibility to internal and testing again:

• Group import - same behavior
• Project import - same behavior

Setting private as restricted visibility level for groups and projects and testing again:

• Group import - same behavior
• Project import - same behavior

NOTE:

Selected levels cannot be used by non-admin users for groups, projects or snippets. If the public level is restricted, user profiles are only visible to logged in users.

Conclusions

• Exported private top-level groups will become internal on import to an internal parent group.
  • Their private sub-groups will remain private.
• internal sub-groups, exported as part of internal parent groups, will import as private, even though their parents imported as internal (because of the internal parent group they imported to).

Behavior - expected

The sub-group imports with the same visibility as on source or stricter (e.g. if the parent group imported as private).