Skip to content

Commit 484d694

Browse files
wass3rwass3rw3rk
wass3r
and
wass3rw3rk
authored
feat(secret): add/update repo allowlist (#608)
Co-authored-by: David May <[email protected]>
1 parent f0658b5 commit 484d694

File tree

5 files changed

+60
-39
lines changed

5 files changed

+60
-39
lines changed

‎action/secret/add.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ func (c *Config) Add(client *vela.Client) error {
5454
Name: &c.Name,
5555
Value: &c.Value,
5656
Images: &c.Images,
57+
RepoAllowlist: &c.RepoAllowlist,
5758
AllowCommand: c.AllowCommand,
5859
AllowSubstitution: c.AllowSubstitution,
5960
}

‎action/secret/secret.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ type Config struct {
2424
Name string
2525
Value string
2626
Images []string
27+
RepoAllowlist []string
2728
AllowEvents []string
2829
AllowCommand *bool
2930
AllowSubstitution *bool

‎action/secret/update.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ func (c *Config) Update(client *vela.Client) error {
5252
Name: &c.Name,
5353
Value: &c.Value,
5454
Images: &c.Images,
55+
RepoAllowlist: &c.RepoAllowlist,
5556
AllowCommand: c.AllowCommand,
5657
AllowSubstitution: c.AllowSubstitution,
5758
}

‎command/secret/add.go‎

Lines changed: 29 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,12 @@ var CommandAdd = &cli.Command{
8181
Aliases: []string{"i"},
8282
Usage: "Provide the image(s) that can access this secret",
8383
},
84+
&cli.StringSliceFlag{
85+
Sources: cli.EnvVars("VELA_REPO_ALLOWLIST", "SECRET_REPO_ALLOWLIST"),
86+
Name: "repo-allowlist",
87+
Aliases: []string{"ra"},
88+
Usage: "provide the repository allowlist for the secret",
89+
},
8490
&cli.StringSliceFlag{
8591
Sources: cli.EnvVars("VELA_EVENTS", "SECRET_EVENTS"),
8692
Name: "event",
@@ -125,19 +131,21 @@ EXAMPLES:
125131
$ {{.FullName}} --secret.engine native --secret.type repo --org MyOrg --repo MyRepo --name foo --value bar --commands false
126132
3. Add an organization secret.
127133
$ {{.FullName}} --secret.engine native --secret.type org --org MyOrg --name foo --value bar
128-
4. Add a shared secret.
134+
4. Add an organization secret and limit use to specific repositories.
135+
$ {{.FullName}} --secret.engine native --secret.type org --org MyOrg --name foo --value bar ---repo-allowlist MyOrg/repo1,MyOrg/repo2
136+
5. Add a shared secret.
129137
$ {{.FullName}} --secret.engine native --secret.type shared --org MyOrg --team octokitties --name foo --value bar
130-
5. Add a repository secret with all event types enabled.
138+
6. Add a repository secret with all event types enabled.
131139
$ {{.FullName}} --secret.engine native --secret.type repo --org MyOrg --repo MyRepo --name foo --value bar --event comment --event deployment --event pull_request --event push --event tag
132-
6. Add a repository secret with an image whitelist.
140+
7. Add a repository secret with an image whitelist.
133141
$ {{.FullName}} --secret.engine native --secret.type repo --org MyOrg --repo MyRepo --name foo --value bar --image alpine --image golang:* --image postgres:latest
134-
7. Add a secret with value from a file.
142+
8. Add a secret with value from a file.
135143
$ {{.FullName}} --secret.engine native --secret.type repo --org MyOrg --repo MyRepo --name foo --value @secret.txt
136-
8. Add a repository secret with json output.
144+
9. Add a repository secret with json output.
137145
$ {{.FullName}} --secret.engine native --secret.type repo --org MyOrg --repo MyRepo --name foo --value bar --output json
138-
9. Add a secret or secrets from a file.
146+
10. Add a secret or secrets from a file.
139147
$ {{.FullName}} --file secret.yml
140-
10. Add a secret when config or environment variables are set.
148+
11. Add a secret when config or environment variables are set.
141149
$ {{.FullName}} --org MyOrg --repo MyRepo --name foo --value bar
142150
143151
DOCUMENTATION:
@@ -167,19 +175,20 @@ func add(_ context.Context, c *cli.Command) error {
167175
//
168176
// https://pkg.go.dev/github.com/go-vela/cli/action/secret?tab=doc#Config
169177
s := &secret.Config{
170-
Action: internal.ActionAdd,
171-
Engine: c.String(internal.FlagSecretEngine),
172-
Type: c.String(internal.FlagSecretType),
173-
Org: c.String(internal.FlagOrg),
174-
Repo: c.String(internal.FlagRepo),
175-
Team: c.String("team"),
176-
Name: c.String("name"),
177-
Value: c.String("value"),
178-
Images: c.StringSlice("image"),
179-
AllowEvents: c.StringSlice("event"),
180-
File: c.String("file"),
181-
Output: c.String(internal.FlagOutput),
182-
Color: output.ColorOptionsFromCLIContext(c),
178+
Action: internal.ActionAdd,
179+
Engine: c.String(internal.FlagSecretEngine),
180+
Type: c.String(internal.FlagSecretType),
181+
Org: c.String(internal.FlagOrg),
182+
Repo: c.String(internal.FlagRepo),
183+
Team: c.String("team"),
184+
Name: c.String("name"),
185+
Value: c.String("value"),
186+
Images: c.StringSlice("image"),
187+
RepoAllowlist: c.StringSlice("repo-allowlist"),
188+
AllowEvents: c.StringSlice("event"),
189+
File: c.String("file"),
190+
Output: c.String(internal.FlagOutput),
191+
Color: output.ColorOptionsFromCLIContext(c),
183192
}
184193

185194
// check if allow_command and allow_substitution are provided

‎command/secret/update.go‎

Lines changed: 28 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,12 @@ var CommandUpdate = &cli.Command{
8181
Aliases: []string{"i"},
8282
Usage: "provide the image(s) that can access this secret",
8383
},
84+
&cli.StringSliceFlag{
85+
Sources: cli.EnvVars("VELA_REPO_ALLOWLIST", "SECRET_REPO_ALLOWLIST"),
86+
Name: "repo-allowlist",
87+
Aliases: []string{"ra"},
88+
Usage: "provide the repository allowlist for the secret",
89+
},
8490
&cli.StringSliceFlag{
8591
Sources: cli.EnvVars("VELA_EVENTS", "SECRET_EVENTS"),
8692
Name: "event",
@@ -127,17 +133,19 @@ EXAMPLES:
127133
$ {{.FullName}} --secret.engine native --secret.type org --org MyOrg --name foo --value bar
128134
4. Update a shared secret.
129135
$ {{.FullName}} --secret.engine native --secret.type shared --org MyOrg --team octokitties --name foo --value bar
130-
5. Update a repository secret with all event types enabled.
136+
5. Update a shared secret to limit use to specific repositories.
137+
$ {{.FullName}} --secret.engine native --secret.type shared --org MyOrg --team octokitties --name foo --repo-allowlist MyOrg/repo1,MyOrg/repo2
138+
6. Update a repository secret with all event types enabled.
131139
$ {{.FullName}} --secret.engine native --secret.type repo --org MyOrg --repo MyRepo --name foo --event comment --event deployment --event pull_request --event push --event tag
132-
6. Update a repository secret with an image whitelist.
140+
7. Update a repository secret with an image whitelist.
133141
$ {{.FullName}} --secret.engine native --secret.type repo --org MyOrg --repo MyRepo --name foo --image alpine --image golang:* --image postgres:latest
134-
7. Update a secret with value from a file.
142+
8. Update a secret with value from a file.
135143
$ {{.FullName}} --secret.engine native --secret.type repo --org MyOrg --repo MyRepo --name foo --value @secret.txt
136-
8. Update a repository secret with json output.
144+
9. Update a repository secret with json output.
137145
$ {{.FullName}} --secret.engine native --secret.type repo --org MyOrg --repo MyRepo --name foo --value bar --output json
138-
9. Update a secret or secrets from a file.
146+
10. Update a secret or secrets from a file.
139147
$ {{.FullName}} --file secret.yml
140-
10. Update a secret when config or environment variables are set.
148+
11. Update a secret when config or environment variables are set.
141149
$ {{.FullName}} --org MyOrg --repo MyRepo --name foo --value bar
142150
143151
DOCUMENTATION:
@@ -167,19 +175,20 @@ func update(_ context.Context, c *cli.Command) error {
167175
//
168176
// https://pkg.go.dev/github.com/go-vela/cli/action/secret?tab=doc#Config
169177
s := &secret.Config{
170-
Action: internal.ActionUpdate,
171-
Engine: c.String(internal.FlagSecretEngine),
172-
Type: c.String(internal.FlagSecretType),
173-
Org: c.String(internal.FlagOrg),
174-
Repo: c.String(internal.FlagRepo),
175-
Team: c.String("team"),
176-
Name: c.String("name"),
177-
Value: c.String("value"),
178-
Images: c.StringSlice("image"),
179-
AllowEvents: c.StringSlice("event"),
180-
File: c.String("file"),
181-
Output: c.String(internal.FlagOutput),
182-
Color: output.ColorOptionsFromCLIContext(c),
178+
Action: internal.ActionUpdate,
179+
Engine: c.String(internal.FlagSecretEngine),
180+
Type: c.String(internal.FlagSecretType),
181+
Org: c.String(internal.FlagOrg),
182+
Repo: c.String(internal.FlagRepo),
183+
Team: c.String("team"),
184+
Name: c.String("name"),
185+
Value: c.String("value"),
186+
Images: c.StringSlice("image"),
187+
RepoAllowlist: c.StringSlice("repo-allowlist"),
188+
AllowEvents: c.StringSlice("event"),
189+
File: c.String("file"),
190+
Output: c.String(internal.FlagOutput),
191+
Color: output.ColorOptionsFromCLIContext(c),
183192
}
184193

185194
// check if allow_command and allow_substitution are provided

0 commit comments

Comments
 (0)