|
2 | 2 | title: Policy on actions |
3 | 3 | weight: 50 |
4 | 4 | --- |
5 | | -# Policy on Pipelines-as-Code actions |
6 | 5 |
|
7 | | -Pipelines-as-Code has the concepts of Policy to let you control an action allowed |
8 | | -to be executed by a set of users belonging to a Team on an Organisation as |
9 | | -defined on GitHub or other Git Providers (only GitHub and Gitea is supported at |
10 | | -the moment). |
| 6 | +# Policy on Pipelines-as-Code Actions |
11 | 7 |
|
12 | | -## List of actions supported |
| 8 | +Pipelines-as-Code uses policies to control which actions can be performed by |
| 9 | +users who belong to specific teams within an organization, as defined on GitHub |
| 10 | +or other supported Git providers (currently GitHub and Gitea). |
13 | 11 |
|
14 | | -* `pull_request` - This action is triggering the CI on Pipelines-as-Code, |
15 | | - specifying a team will only allow the members of the team to trigger the CI |
16 | | - and will not allow other members regadless if they are Owners or Collaborators |
17 | | - of the repository or the Organization. The OWNERS file is still taken into |
18 | | - account and will as well allow the members of the OWNERS file to trigger the |
19 | | - CI. |
20 | | -* `ok_to_test` - This action will let a user belonging to the allowed team to |
21 | | - issue a `/ok-to-test` comment on a Pull Request to trigger the CI on |
22 | | - Pipelines-as-Code, this let running the CI on Pull Request contributed by a |
23 | | - non collaborator of the repository or the organisation. This apply to the |
24 | | - `/test` and `/retest` commands as well. This take precedence on the |
25 | | - `pull_request` action. |
| 12 | +## Supported Actions |
26 | 13 |
|
27 | | -## Configuring the Policy on the Repository CR |
| 14 | +* `pull_request` - This action triggers the CI in Pipelines-as-Code. Specifying |
| 15 | + a team restricts the ability to trigger CI to members of that team, regardless |
| 16 | + of whether they are repository or organization owners or |
| 17 | + collaborators. However, members listed in the `OWNERS` file are still |
| 18 | + permitted to trigger the CI. |
28 | 19 |
|
29 | | -To configure the Policy on the Repository CR you need to add the following to the setting of the Repository CR: |
| 20 | +* `ok_to_test` - This action allows users who are members of the specified team |
| 21 | + to trigger the CI for a pull request by commenting `/ok-to-test`. This enables |
| 22 | + CI to run on pull requests submitted by contributors who are not collaborators |
| 23 | + of the repository or organization. It also applies to `/test` and `/retest` |
| 24 | + commands. This action takes precedence over the `pull_request` action. |
| 25 | + |
| 26 | +## Configuring Policies in the Repository CR |
| 27 | + |
| 28 | +To set up policies in the Repository CR, include the following configuration: |
30 | 29 |
|
31 | 30 | ```yaml |
32 | 31 | apiVersion: "pipelinesascode.tekton.dev/v1alpha1" |
|
43 | 42 | - ci-users |
44 | 43 | ``` |
45 | 44 |
|
46 | | -Users in `ci-admins` team will be able to let other users run the CI on the pull |
47 | | -request and users in `ci-users` team will be able to run the CI on their own |
48 | | -pull request. |
49 | | - |
50 | | -## Configuring teams on GitHub |
51 | | - |
52 | | -You will need to configure the GitHub Apps on your organisation to use this |
53 | | -feature. |
54 | | - |
55 | | -See the documentation on GitHub to configure the teams: |
56 | | - |
57 | | -<https://docs.github.com/en/organizations/organizing-members-into-teams/about-teams> |
58 | | - |
59 | | -## Configuring teams on Gitea |
| 45 | +In this example: |
60 | 46 |
|
61 | | -Teams on Gitea are configured on the Organization level. No documentation is |
62 | | -available but you can look at the GitHub documentation to get an idea of how to |
63 | | -configure it. |
| 47 | +* Members of the `ci-admins` team can authorize other users to run the CI on |
| 48 | + pull requests. |
| 49 | +* Members of the `ci-users` team can run CI on their own pull requests. |
0 commit comments