Unable to deploy PRs about woodpecker HOT 8 CLOSED

IMO, we should have a config to enable or disable deployment on PRs. We can keep it disabled by default. However, for private environments the risk is minimal.

from woodpecker.

We disabled PR deployments due to security concerns, because it would allow you to access deploy secrets even if you're not a repo admin.
To be honestly, I don't see a good way to prevent this except a new repo config with a warning that this can leak your secrets.
Do you have any idea?

from woodpecker.

Deploy uses secrets enabled for the deploy event. Clicking the deloy button can be done by every repo member (not by externals), right?

from woodpecker.

Clicking the deloy button can be done by every repo member (not by externals), right?

Yes. So you can access any secret if you have push perms but they should only be available with admin perms.

from woodpecker.

So you can access any secret if you have push perms

I might be wrong, but aren't just secrets with the deploy filter exposed to the compiler?

from woodpecker.

I might be wrong, but aren't just secrets with the deploy filter exposed to the compiler?

I'm not sure about this, but how is this important?

The workflow to get a secret that's only intended for deployments would be:

1. Open a PR with a malicious woodpecker config (e.g. sending secret value to a remote server)
2. Wait until the pipeline finished
3. Click the "deploy" button
4. The same pipeline will be executed with the deploy event and thus has access to all deploy secrets

from woodpecker.

Click the "deploy" button

As clicking the deploy button can only be done by a repo member.

Isn't it the same risk as this:

• A member pushes to a branch
• Wait until the pipeline finished
• Click the "deploy" button
• ...

from woodpecker.

Isn't it the same risk as this:

In general, yes, however, you can easily block that using branch protections. Blocking PRs is much harder and probably nobody will do it as it drastically reduces usability.

Maybe it's the best idea to be able to disable the deploy button completely, but if it's enabled allow all events? And add a warning similar to PR secrets?

from woodpecker.