secrets may be handled securely w.r.t. use in PRs #463
Labels
No labels
0 points
0.5 points
1 point
13 points
2 points
21 points
3 points
34 points
5 points
55 points
8 points
ambition
application-offering
ambition
configure-applications
ambition
front-end
ambition/install-applications
ambition
security
ambition
switch-host
ambition
update-applications
ambition
user-management
api service
blocked
component: fediversity panel
component: nixops4
documentation
estimation high: >3d
estimation low: <2h
estimation mid: <8h
infinite points
productisation
project-management
question
role: application developer
role: application operator
role: hosting provider
role: maintainer
security
technical debt
testing
type unclear
type: bug
type: deliverable
type: key result
type: objective
type: task
type: user story
user experience
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Blocks
#291 code passes security check
fediversity/fediversity
#335 sign-up for external developers
fediversity/fediversity
Reference
fediversity/fediversity#463
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
As a developer,
I want for secrets for use in CI to allow scoping,
so that we may prevent their use in PRs.
buildbot-nixlix is dropping for being somewhat simple, in favor of buildkite, tho @edef couldn't confidently recommend that one eitherDo we need something more than simple? Hydra for sure is overkill for our purposes.
honestly i don't think so, this just seems like bare basics, yet somehow gitea ain't got it
hm, do buildbot's secrets handle scope? @fricklerhandwerk
their docs seem not to mention this, leaving woodpecker as my primary known option - raising the question why that hasn't been as popular among nix projects.
it does seem nice about
buildbot-nixthat it seems to explicitly handle effects, but yeah.i've tried to ask around now given i've found seemingly no options matching what we'd like
secrets may be scoped to prevent use in PRsto secrets may be handled securely w.r.t. use in PRsturns out
forgejo-runner'son.pull_requestalready prevents use in PRs, so this actually seems already goodmoving CI notes to #362