fix(security): reject new pipelines from unauthenticated HTTP API

server/src/api.rs

@@ -266,6 +266,7 @@ pub async fn pipeline_new_pr(
     pr: u64,
     archs: Option<&str>,
     source: JobSource,
+    no_fork: bool,
 ) -> anyhow::Result<(Pipeline, Vec<Job>)> {
     match octocrab::instance()
         .pulls("AOSC-Dev", "aosc-os-abbs")
@@ -288,6 +289,10 @@ pub async fn pipeline_new_pr(
 
             let fork = pr.head.repo.as_ref().and_then(|x| x.fork).unwrap_or(false);
 
+            if fork && no_fork {
+                bail!("Only maintainers can start build pipelines")
+            }
+
             // find lines starting with #buildit
             let packages = get_packages_from_pr(&pr);
             if !packages.is_empty() {

server/src/bot.rs

@@ -354,7 +354,7 @@ async fn create_pipeline_from_pr(
     bot: &Bot,
 ) -> ResponseResult<()> {
     match wait_with_send_typing(
-        pipeline_new_pr(pool, pr_number, archs, JobSource::Telegram(chat.0)),
+        pipeline_new_pr(pool, pr_number, archs, JobSource::Telegram(chat.0), false),
         bot,
         chat.0,
     )

server/src/routes/pipeline.rs

@@ -58,6 +58,7 @@ pub async fn pipeline_new_pr(
         payload.pr,
         payload.archs.as_deref(),
         JobSource::Manual,
+        true,
     )
     .await?;
     Ok(Json(PipelineNewResponse { id: pipeline.id }))

server/src/routes/webhook.rs

@@ -130,6 +130,7 @@ async fn pipeline_new_pr_impl(
         pr,
         archs,
         api::JobSource::GitHub { pr, user: gh_user },
+        false,
     )
     .await;