what is the purpose of --no-command-eval?

[nhooyr]

Can't someone just evaluate things in a script? What value does this option add?

[toolmantim]

Commands are sourced from the BK instructions, whereas scripts are sourced from your repository. In the case of a malicious job instruction from Buildkite, the option provides a layer of defense. Does that make it clear?

[nhooyr]

Not clear to me. Could you provide an example of the protection it adds?

[toolmantim]

I’ll try to clarify! This option doesn’t provide any protection for people with repository access… like you said, they can just change the executable scripts.

This option is usually used alongside the other options and techniques (e.g. hooks that do whitelisting), when you’re trying to ensure that only things that have been sourced from your repositories are being executed (and not arbitrary commands defined only in Buildkite or by a malicious third party).