Block workflows on unallowed pipeline configuration changes

[apreiml]

We're using woodpecker combined with gitea and protected main branches. A workflow can deploy the main branch. Every branch pushed on the repo causes the pipeline to run.

How can I prevent the workflow execution if someone edits the pipeline configuration in a branch? Since I think currently anyone can alter the configs to push a random branch to production.

Is there anything that helps to achieve this? Did anybody try to solve this already?

If not, I'd like to pursue the idea to use CODEOWNERS in gitea, to protect the woodpecker configs. But then I'd need a pipeline step, that checks that before the pipeline of the project is executed. Is there a way to globally add such a pipeline step for all projects in woodpecker?

Another idea would be maybe to add such a feature to the forge integration, that accesses the CODEOWNER files and checks on config edits.

[6543]

if you want it right now, an configuration extension could enforce it by adding a step that check this and fails pipeline early if not meet

[apreiml]

Thanks for the pointer, i've missed that one!

[qwerty287]

You're probably able to implement this using a config extension as @6543 said, but I'm against adding something like this.

Woodpecker's trust model is linked to the forge. Anyone with push access to the repo will also be able to manage pipelines in woodpecker itself (if they're able to log in).
So you must make sure that users with push access are trusted,

[apreiml]

Ok. Makes sense. Thanks!