Fail on missing secrets (#2749)

Co-authored-by: pat-s <patrick.schratz@gmail.com>

docs/docusaurus.config.ts

@@ -1,5 +1,5 @@
 import { themes } from 'prism-react-renderer';
-import type {Config} from '@docusaurus/types';
+import type { Config } from '@docusaurus/types';
 import type * as Preset from '@docusaurus/preset-classic';
 import * as path from 'path';
 
@@ -14,8 +14,7 @@ const config: Config = {
   organizationName: 'woodpecker-ci',
   projectName: 'woodpecker-ci.github.io',
   trailingSlash: false,
-  themeConfig:
+  themeConfig: {
-    ({
     navbar: {
       title: 'Woodpecker',
       logo: {
@@ -154,7 +153,7 @@ const config: Config = {
     colorMode: {
       respectPrefersColorScheme: true,
     },
-    } satisfies Preset.ThemeConfig),
+  } satisfies Preset.ThemeConfig,
   plugins: [
     () => ({
       name: 'docusaurus-plugin-favicon',
@@ -206,7 +205,7 @@ const config: Config = {
   presets: [
     [
       '@docusaurus/preset-classic',
-      ({
+      {
         docs: {
           sidebarPath: require.resolve('./sidebars.js'),
           editUrl: 'https://github.com/woodpecker-ci/woodpecker/edit/main/docs/',
@@ -235,7 +234,7 @@ const config: Config = {
         theme: {
           customCss: require.resolve('./src/css/custom.css'),
         },
-      } satisfies Preset.Options),
+      } satisfies Preset.Options,
     ],
     [
       'redocusaurus',
@@ -265,8 +264,8 @@ const config: Config = {
     }),
   },
   markdown: {
-    format: 'detect'
+    format: 'detect',
-  }
+  },
 };
 
 export default config;

pipeline/frontend/yaml/compiler/compiler.go

@@ -162,7 +162,10 @@ func (c *Compiler) Compile(conf *yaml_types.Workflow) (*backend_types.Config, er
 			Environment: c.cloneEnv,
 		}
 		name := fmt.Sprintf("%s_clone", c.prefix)
-		step := c.createProcess(name, container, backend_types.StepTypeClone)
+		step, err := c.createProcess(name, container, backend_types.StepTypeClone)
+		if err != nil {
+			return nil, err
+		}
 
 		stage := new(backend_types.Stage)
 		stage.Name = name
@@ -183,7 +186,10 @@ func (c *Compiler) Compile(conf *yaml_types.Workflow) (*backend_types.Config, er
 			stage.Alias = container.Name
 
 			name := fmt.Sprintf("%s_clone_%d", c.prefix, i)
-			step := c.createProcess(name, container, backend_types.StepTypeClone)
+			step, err := c.createProcess(name, container, backend_types.StepTypeClone)
+			if err != nil {
+				return nil, err
+			}
 
 			// only inject netrc if it's a trusted repo or a trusted plugin
 			if !c.netrcOnlyTrusted || c.trustedPipeline || (container.IsPlugin() && container.IsTrustedCloneImage()) {
@@ -198,7 +204,10 @@ func (c *Compiler) Compile(conf *yaml_types.Workflow) (*backend_types.Config, er
 		}
 	}
 
-	c.setupCache(conf, config)
+	err := c.setupCache(conf, config)
+	if err != nil {
+		return nil, err
+	}
 
 	// add services steps
 	if len(conf.Services.ContainerList) != 0 {
@@ -214,7 +223,11 @@ func (c *Compiler) Compile(conf *yaml_types.Workflow) (*backend_types.Config, er
 			}
 
 			name := fmt.Sprintf("%s_%s_%d", c.prefix, nameServices, i)
-			step := c.createProcess(name, container, backend_types.StepTypeService)
+			step, err := c.createProcess(name, container, backend_types.StepTypeService)
+			if err != nil {
+				return nil, err
+			}
+
 			stage.Steps = append(stage.Steps, step)
 		}
 		config.Stages = append(config.Stages, stage)
@@ -249,7 +262,10 @@ func (c *Compiler) Compile(conf *yaml_types.Workflow) (*backend_types.Config, er
 		if container.IsPlugin() {
 			stepType = backend_types.StepTypePlugin
 		}
-		step := c.createProcess(name, container, stepType)
+		step, err := c.createProcess(name, container, stepType)
+		if err != nil {
+			return nil, err
+		}
 
 		// inject netrc if it's a trusted repo or a trusted clone-plugin
 		if c.trustedPipeline || (container.IsPlugin() && container.IsTrustedCloneImage()) {
@@ -261,19 +277,25 @@ func (c *Compiler) Compile(conf *yaml_types.Workflow) (*backend_types.Config, er
 		stage.Steps = append(stage.Steps, step)
 	}
 
-	c.setupCacheRebuild(conf, config)
+	err = c.setupCacheRebuild(conf, config)
+	if err != nil {
+		return nil, err
+	}
 
 	return config, nil
 }
 
-func (c *Compiler) setupCache(conf *yaml_types.Workflow, ir *backend_types.Config) {
+func (c *Compiler) setupCache(conf *yaml_types.Workflow, ir *backend_types.Config) error {
 	if c.local || len(conf.Cache) == 0 || c.cacher == nil {
-		return
+		return nil
 	}
 
 	container := c.cacher.Restore(path.Join(c.metadata.Repo.Owner, c.metadata.Repo.Name), c.metadata.Curr.Commit.Branch, conf.Cache)
 	name := fmt.Sprintf("%s_restore_cache", c.prefix)
-	step := c.createProcess(name, container, backend_types.StepTypeCache)
+	step, err := c.createProcess(name, container, backend_types.StepTypeCache)
+	if err != nil {
+		return err
+	}
 
 	stage := new(backend_types.Stage)
 	stage.Name = name
@@ -281,16 +303,21 @@ func (c *Compiler) setupCache(conf *yaml_types.Workflow, ir *backend_types.Confi
 	stage.Steps = append(stage.Steps, step)
 
 	ir.Stages = append(ir.Stages, stage)
+
+	return nil
 }
 
-func (c *Compiler) setupCacheRebuild(conf *yaml_types.Workflow, ir *backend_types.Config) {
+func (c *Compiler) setupCacheRebuild(conf *yaml_types.Workflow, ir *backend_types.Config) error {
 	if c.local || len(conf.Cache) == 0 || c.metadata.Curr.Event != metadata.EventPush || c.cacher == nil {
-		return
+		return nil
 	}
 	container := c.cacher.Rebuild(path.Join(c.metadata.Repo.Owner, c.metadata.Repo.Name), c.metadata.Curr.Commit.Branch, conf.Cache)
 
 	name := fmt.Sprintf("%s_rebuild_cache", c.prefix)
-	step := c.createProcess(name, container, backend_types.StepTypeCache)
+	step, err := c.createProcess(name, container, backend_types.StepTypeCache)
+	if err != nil {
+		return err
+	}
 
 	stage := new(backend_types.Stage)
 	stage.Name = name
@@ -298,4 +325,6 @@ func (c *Compiler) setupCacheRebuild(conf *yaml_types.Workflow, ir *backend_type
 	stage.Steps = append(stage.Steps, step)
 
 	ir.Stages = append(ir.Stages, stage)
+
+	return nil
 }

pipeline/frontend/yaml/compiler/compiler_test.go

@@ -97,7 +97,7 @@ func TestCompilerCompile(t *testing.T) {
 		name        string
 		fronConf    *yaml_types.Workflow
 		backConf    *backend_types.Config
-		expErr   bool
+		expectedErr string
 	}{{
 		name:     "empty workflow, no clone",
 		fronConf: &yaml_types.Workflow{SkipClone: true},
@@ -197,13 +197,24 @@ func TestCompilerCompile(t *testing.T) {
 				}},
 			}},
 		},
+	}, {
+		name: "workflow with missing secret",
+		fronConf: &yaml_types.Workflow{Steps: yaml_types.ContainerList{ContainerList: []*yaml_types.Container{{
+			Name:     "step",
+			Image:    "bash",
+			Commands: []string{"env"},
+			Secrets:  yaml_types.Secrets{Secrets: []*yaml_types.Secret{{Source: "missing", Target: "missing"}}},
+		}}}},
+		backConf:    nil,
+		expectedErr: "secret \"missing\" not found or not allowed to be used",
 	}}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			backConf, err := compiler.Compile(test.fronConf)
-			if test.expErr {
+			if test.expectedErr != "" {
 				assert.Error(t, err)
+				assert.Equal(t, err.Error(), test.expectedErr)
 			} else {
 				// we ignore uuids in steps and only check if global env got set ...
 				for _, st := range backConf.Stages {

pipeline/frontend/yaml/compiler/convert.go

@@ -21,7 +21,6 @@ import (
 	"strings"
 
 	"github.com/google/uuid"
-	"github.com/rs/zerolog/log"
 
 	backend_types "github.com/woodpecker-ci/woodpecker/pipeline/backend/types"
 	"github.com/woodpecker-ci/woodpecker/pipeline/frontend/metadata"
@@ -30,7 +29,7 @@ import (
 	"github.com/woodpecker-ci/woodpecker/pipeline/frontend/yaml/utils"
 )
 
-func (c *Compiler) createProcess(name string, container *yaml_types.Container, stepType backend_types.StepType) *backend_types.Step {
+func (c *Compiler) createProcess(name string, container *yaml_types.Container, stepType backend_types.StepType) (*backend_types.Step, error) {
 	var (
 		uuid = uuid.New()
 
@@ -90,7 +89,7 @@ func (c *Compiler) createProcess(name string, container *yaml_types.Container, s
 		}
 
 		if err := settings.ParamsToEnv(container.Settings, environment, pluginSecrets.toStringMap()); err != nil {
-			log.Error().Err(err).Msg("paramsToEnv")
+			return nil, err
 		}
 	}
 
@@ -112,6 +111,8 @@ func (c *Compiler) createProcess(name string, container *yaml_types.Container, s
 		secret, ok := c.secrets[strings.ToLower(requested.Source)]
 		if ok && secret.Available(container) {
 			environment[strings.ToUpper(requested.Target)] = secret.Value
+		} else {
+			return nil, fmt.Errorf("secret %q not found or not allowed to be used", requested.Source)
 		}
 	}
 
@@ -213,7 +214,7 @@ func (c *Compiler) createProcess(name string, container *yaml_types.Container, s
 		IpcMode:        ipcMode,
 		Ports:          ports,
 		BackendOptions: backendOptions,
-	}
+	}, nil
 }
 
 func (c *Compiler) stepWorkdir(container *yaml_types.Container) string {