Merge pull request #63 from bluesliverx/master

Add minimum permissions check for label trigger
jenkinsci · Apr 17, 2023 · 9ff13b6 · 9ff13b6
2 parents e96c665 + f58e235
commit 9ff13b6
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 2 deletions.
diff --git a/src/main/java/com/adobe/jenkins/github_pr_comment_build/IssueLabelGHEventSubscriber.java b/src/main/java/com/adobe/jenkins/github_pr_comment_build/IssueLabelGHEventSubscriber.java
@@ -147,6 +147,9 @@ protected void onEvent(GHEvent event, String payload) {
                                     Pattern pattern = Pattern.compile(expectedLabel,
                                             Pattern.CASE_INSENSITIVE | Pattern.DOTALL);
                                     if (pattern.matcher(label).matches()) {
+                                        if (!GithubHelper.isAuthorized(job, labellingAuthor, branchProp.getMinimumPermissions())) {
+                                            continue;
+                                        }
                                         if (alreadyTriggeredJobs.add(job)) {
                                             ParameterizedJobMixIn.scheduleBuild2(job, 0,
                                                     new CauseAction(new GitHubPullRequestLabelCause(

diff --git a/src/main/java/com/adobe/jenkins/github_pr_comment_build/TriggerPRLabelBranchProperty.java b/src/main/java/com/adobe/jenkins/github_pr_comment_build/TriggerPRLabelBranchProperty.java
@@ -3,15 +3,14 @@
 import hudson.Extension;
 import hudson.model.Job;
 import hudson.model.Run;
-import jenkins.branch.BranchProperty;
 import jenkins.branch.BranchPropertyDescriptor;
 import jenkins.branch.JobDecorator;
 import org.kohsuke.stapler.DataBoundConstructor;
 
 /**
  * Allows a GitHub pull request comment to trigger an immediate build based on a comment string.
  */
-public class TriggerPRLabelBranchProperty extends BranchProperty {
+public class TriggerPRLabelBranchProperty extends TriggerBranchProperty {
     /**
      * The comment body to trigger a new build on.
      */

diff --git a/...urces/com/adobe/jenkins/github_pr_comment_build/TriggerPRLabelBranchProperty/config.jelly b/...urces/com/adobe/jenkins/github_pr_comment_build/TriggerPRLabelBranchProperty/config.jelly
@@ -5,4 +5,7 @@
     <f:entry title="gitHub label regex" field="label">
         <f:textbox />
     </f:entry>
+    <f:entry field="minimumPermissions" title="Minimum Permissions on repository to trigger the build">
+        <f:select default="WRITE" />
+    </f:entry>
 </j:jelly>