Uploaded image for project: 'OpenShift Pipelines'
  1. OpenShift Pipelines
  2. SRVKP-3088

Github APP: let repo not trust organisation users

XMLWordPrintable

    • Github APP: let repo not trust organisation users
    • 8
    • False
    • None
    • False
    • Hide
      By default, when using for example the GitHub provider, if your repository is belong to an organization, the users belonging to that organization are granted automatic permissions to initiate the pipelines. However, considering the potential existence of malicious users within a large organization and the need to exercise caution, there may be certain repositories for which we do not wish to extend trust to everyone.

      To address this, you have the option to deactivate this functionality by configuring the repository settings and setting the only_trusts_users_from_repository parameter to true.

      example:

      spec:
        settings:
          only_trusts_users_from_repository: true
      Show
      By default, when using for example the GitHub provider, if your repository is belong to an organization, the users belonging to that organization are granted automatic permissions to initiate the pipelines. However, considering the potential existence of malicious users within a large organization and the need to exercise caution, there may be certain repositories for which we do not wish to extend trust to everyone. To address this, you have the option to deactivate this functionality by configuring the repository settings and setting the only_trusts_users_from_repository parameter to true. example: spec:   settings:     only_trusts_users_from_repository: true

      < High-Level description of the feature ie: Executive Summary >

      Goals

      when using github app provider pac trust automatically everyone in the organisation to run the CI.

       

      it's convenient, but for some sensitive repository and where the full organisations member cannot be trusted we want to be able to override that setting and only allow the contributors on repository to be trusted.

      Requirements

      Requirements Notes IS MVP
           

        • (Optional) Use Cases

      < What are we making, for who, and why/what problem are we solving?>

      Out of scope

      <Defines what is not included in this story>

      Dependencies

      < Link or at least explain any known dependencies. >

      Background, and strategic fit

      < What does the person writing code, testing, documenting need to know? >

      Assumptions

      < Are there assumptions being made regarding prerequisites and dependencies?>

      < Are there assumptions about hardware, software or people resources?>

      Customer Considerations

      < Are there specific customer environments that need to be considered (such as working with existing h/w and software)?>

      Documentation Considerations

      < What educational or reference material (docs) is required to support this product feature? For users/admins? Other functions (security officers, etc)? >

      What does success look like?

      < Does this feature have doc impact? Possible values are: New Content, Updates to existing content, Release Note, or No Doc Impact?>

      QE Contact

      < Are there assumptions being made regarding prerequisites and dependencies?>

      < Are there assumptions about hardware, software or people resources?>

      Impact

      < If the feature is ordered with other work, state the impact of this feature on the other work>

      Related Architecture/Technical Documents

      <links>

      Done Checklist

      • Acceptance criteria are met
      • Non-functional properties of the Feature have been validated (such as performance, resource, UX, security or privacy aspects)
      • User Journey automation is delivered
      • Support and SRE teams are provided with enough skills to support the feature in production environment

              cboudjna@redhat.com Chmouel Boudjnah
              cboudjna@redhat.com Chmouel Boudjnah
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: