mirrors/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2024-12-27 19:00:35 +00:00
Code Issues Projects Releases Wiki Activity

Update docs section about "Custom clone plugins" (#4618)

Browse source 
Co-authored-by: Robert Kaussow <mail@thegeeklab.de>
This commit is contained in:
Patrick Schratz 2024-12-25 23:57:19 +01:00 committed by GitHub
parent 2bbd221e82
commit 4009f1dd53
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.cspell.json
View file

@ -13,6 +13,7 @@
"anbraten",
"antfu",
"apimachinery",
"appleboy",
"Archlinux",
"autoincr",
"automerge",

14
docs/docs/20-usage/75-project-settings.md
View file

@ -41,11 +41,19 @@ Only server admins can set this option. If you are not a server admin this optio
## Custom trusted clone plugins
The clone step may require Git credentials (e.g. for private repos) which are injected via `netrc`.
During the clone process, Git credentials (e.g., for private repositories) may be required.
These credentials are provided via [`netrc`](https://everything.curl.dev/usingcurl/netrc.html).
They are only injected into trusted plugins listed in the env var `WOODPECKER_PLUGINS_TRUSTED_CLONE` or in this repo setting.
These credentials are injected only into trusted plugins specified in the environment variable `WOODPECKER_PLUGINS_TRUSTED_CLONE` (an instance-wide Woodpecker server setting) or declared in this repository-level setting.
This allows you to use a trusted plugin for in the clone section or as a step to pull or push using your git credentials.
With these credentials, it’s possible to perform any Git operations, including pushing changes back to the repo.
To prevent unauthorized access or misuse, a plugin allowlist is required, either on the instance level or the repository level.
Without an explicit allowlist, a malicious contributor could exploit a custom clone plugin in a Pull Request to reveal or transfer these credentials during the clone step.
:::info
This setting does not affect subsequent steps, nor does it allow direct pushes to the repository.
To enable pushing changes, you can inject Git credentials as a secret or use a dedicated plugin, such as [appleboy/drone-git-push](https://woodpecker-ci.org/plugins/Git%20Push).
:::
## Project visibility