Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Let user define pipeline provenance definition #1258

Merged

Conversation

chmouel
Copy link
Member

@chmouel chmouel commented Apr 28, 2023

Let user define pipeline provenance definition

By default on a Push or a Pull Request, Pipelines as Code will fetch the
PipelineRun definition from the branch of where the event has been triggered.

This behavior can be changed by setting the setting pipelinerun_provenance.
The setting currently accept two values:

  • source: The default behavior, the PipelineRun definition will be fetched
    from the branch of where the event has been triggered.
  • default_branch: The PipelineRun definition will be fetched from the default
    branch of the repository as configured on the git platform. For example
    main, master, or trunk.

Example:

This configuration specifies a repository named my-repo with a URL of
https://github.com/my-org/my-repo. It also sets the pipelinerun_provenance
setting to default_branch, which means that the PipelineRun definition will be
fetched from the default branch of the repository.

apiVersion: "pipelinesascode.tekton.dev/v1alpha1"
kind: Repository
metadata:
  name: my-repo
spec:
  url: "https://github.com/owner/repo"
  settings:
    pipelinerun_provenance: "default_branch"

Letting the user specify the provenance of the PipelineRun definition to default
branch is another layer of security. It ensures that only the one who has the
right to merge commit to the default branch can change the PipelineRun and have
access to the infrastrucutre.

Signed-off-by: Chmouel Boudjnah chmouel@redhat.com

SRVKP: https://issues.redhat.com/browse/SRVKP-2896

Changes

Submitter Checklist

  • β™½ Run make test lint before submitting a PR (ie: with pre-commit, no need to waste CPU cycle on CI
  • πŸ“– If you are adding a user facing feature or make a change of the behavior, please verify that you have documented it
  • πŸ§ͺ 100% coverage is not a target but most of the time we would rather have a unit test if you make a code change.
  • 🎁 If that's something that is possible to do please ensure to check if we can add a e2e test.
  • πŸ”Ž If there is a flakiness in the CI tests then don't necessary ignore it, better get the flakyness fixed before merging or if that's not possible there is a good reason to bypass it. (token rate limitation may be a good reason to skip).

@pipelines-as-code
Copy link

pipelines-as-code bot commented Apr 28, 2023

Golang test coverage difference report

Coverage decreased by 0.05%. πŸ”” Shame πŸ””

Package report
package                                                                            before    after    delta
-------                                                                           -------  -------  -------
pkg/acl                                                                           100.00%  100.00%         
pkg/action                                                                         68.75%   68.75%         
pkg/adapter                                                                        72.41%   72.41%         
pkg/apis/features                                                                 100.00%  100.00%         
pkg/cli/info                                                                       88.23%   88.23%         
pkg/cli/prompt                                                                     55.38%   55.38%         
pkg/cli/status                                                                     95.23%   95.23%         
pkg/cli/webhook                                                                    49.40%   49.40%         
pkg/cmd/tknpac/bootstrap                                                            5.72%    5.72%         
pkg/cmd/tknpac/completion                                                          50.00%   50.00%         
pkg/cmd/tknpac/create                                                              44.14%   44.14%         
pkg/cmd/tknpac/describe                                                            46.31%   46.31%         
pkg/cmd/tknpac/generate                                                            62.20%   62.20%         
pkg/cmd/tknpac/info                                                                62.50%   62.50%         
pkg/cmd/tknpac/list                                                                46.47%   46.47%         
pkg/cmd/tknpac/resolve                                                             71.42%   71.42%         
pkg/cmd/tknpac/webhook                                                             52.47%   52.47%         
pkg/consoleui                                                                      84.12%   84.12%         
pkg/customparams                                                                   92.64%   92.64%         
pkg/events                                                                         73.33%   73.33%         
pkg/formatting                                                                     98.71%   98.71%         
pkg/git                                                                            84.84%   84.84%         
pkg/hub                                                                            90.62%   90.62%         
pkg/kubeinteraction                                                                52.50%   52.50%         
pkg/kubeinteraction/status                                                         77.27%   77.27%         
pkg/matcher                                                                        86.47%   86.47%         
pkg/params/clients                                                                 14.86%   14.86%         
pkg/params/settings                                                                79.48%   79.48%         
pkg/pipelineascode                                                                 80.90%   81.04%   +0.14%
pkg/provider                                                                       76.19%   76.19%         
pkg/provider/bitbucketcloud                                                        86.98%   86.78%   -0.20%
pkg/provider/bitbucketserver                                                       88.18%   88.61%   +0.43%
pkg/provider/gitea                                                                 33.44%   34.02%   +0.58%
pkg/provider/github                                                                83.03%   82.98%   -0.05%
pkg/provider/github/app                                                            78.33%   78.33%         
pkg/provider/gitlab                                                                86.56%   86.31%   -0.25%
pkg/random                                                                        100.00%  100.00%         
pkg/reconciler                                                                     46.25%   46.25%         
pkg/resolve                                                                        87.93%   87.93%         
pkg/secrets                                                                        92.85%   92.85%         
pkg/sort                                                                           51.20%   51.20%         
pkg/sync                                                                           91.13%   91.13%         
pkg/templates                                                                     100.00%  100.00%         
pkg/webhook                                                                        22.22%   22.22%         
                                                                          total:   67.21%   67.16%   -0.05%

@chmouel chmouel changed the title Move customparams feature to its own package Let user define pipeline provenance definition Apr 28, 2023
@chmouel chmouel force-pushed the definition-from-another-place branch from 259d6f7 to cd9c07c Compare April 28, 2023 17:35
@chmouel
Copy link
Member Author

chmouel commented Apr 28, 2023

/retest

Comment on lines 196 to 199
### Reporting to a custom Dashboard/Console

Alternatively, you have the ability to configure the links to go to your custom
dashboard using the following settings:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we require this doc change here in this PR πŸ€” asking because doc change is related to custom console param

Copy link
Member Author

@chmouel chmouel May 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i rephrase all the time the doc if i find a missphrase or misspell.. no need for new pr or commit...

@chmouel chmouel force-pushed the definition-from-another-place branch 4 times, most recently from 9d0d634 to 0fe2d55 Compare May 2, 2023 07:21
@savitaashture
Copy link
Member

PR looks good to me πŸ‘
Verified by applying PR changes on Openshift cluster

We can merge once CI is green

By default on a `Push` or a `Pull Request`, Pipelines as Code will fetch the
PipelineRun definition from the branch of where the event has been triggered.

This behavior can be changed by setting the setting `pipelinerun_provenance`.
The setting currently accept two values:

- `source`: The default behavior, the PipelineRun definition will be fetched
  from the branch of where the event has been triggered.
- `default_branch`: The PipelineRun definition will be fetched from the default
  branch of the repository as configured on the git platform. For example
  `main`, `master`, or `trunk`.

Example:

This configuration specifies a repository named my-repo with a URL of
<https://github.com/my-org/my-repo>. It also sets the `pipelinerun_provenance`
setting to `default_branch`, which means that the PipelineRun definition will be
fetched from the default branch of the repository.

```yaml
apiVersion: "pipelinesascode.tekton.dev/v1alpha1"
kind: Repository
metadata:
  name: my-repo
spec:
  url: "https://github.com/owner/repo"
  settings:
    pipelinerun_provenance: "default_branch"
```

SRVKP: https://issues.redhat.com/browse/SRVKP-2896

Letting the user specify the provenance of the PipelineRun definition to default
branch is another layer of security. It ensures that only the one who has the
right to merge commit to the default branch can change the PipelineRun and have
access to the infrastrucutre.

Signed-off-by: Chmouel Boudjnah <chmouel@redhat.com>
@chmouel chmouel force-pushed the definition-from-another-place branch from 8318215 to 85d7937 Compare May 2, 2023 12:46
@savitaashture savitaashture merged commit 28f7790 into openshift-pipelines:main May 2, 2023
5 checks passed
@savitaashture
Copy link
Member

πŸŽ‰ πŸŽ‰

@chmouel chmouel deleted the definition-from-another-place branch May 2, 2023 20:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants