Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(api/webhook): build approval for fork-no-write #1088

Merged
merged 35 commits into from
Mar 20, 2024

Conversation

jbrockopp
Copy link
Contributor

@jbrockopp jbrockopp commented Mar 20, 2024

This change resolves an issue with the new build approval feature introduced in v0.23:

https://github.com/go-vela/community/blob/main/releases/v0.23.md

The issue is builds triggered from a fork by a user with admin perms were being forced to wait for an approval.

This is unexpected behavior because the repos in question have a build approval policy of fork-no-write:

https://github.com/go-vela/types/blob/v0.23.2/constants/repo.go#L26-L28

After successfully reproducing the issue locally, I was able to determine the code causing this:

server/api/webhook/post.go

Lines 773 to 786 in 1809638

case constants.ApproveForkNoWrite:
// determine if build sender has write access to parent repo. If not, this call will result in an error
_, err = scm.FromContext(c).RepoAccess(ctx, b.GetSender(), u.GetToken(), r.GetOrg(), r.GetName())
if err != nil {
err = gatekeepBuild(c, b, repo, u)
if err != nil {
util.HandleError(c, http.StatusInternalServerError, err)
}
return
}
fallthrough
case constants.ApproveOnce:

This code is setup to check if the build sender has access to the repo:

  • if they don't, then we call the function to gatekeep the build until an approval is provided
  • if they do, then we fallthrough to the first-time approval policy case statement

After this change, we'll no longer fallthrough to the first-time approval policy case statement.

@jbrockopp jbrockopp added the bug Indicates a bug label Mar 20, 2024
@jbrockopp jbrockopp self-assigned this Mar 20, 2024
api/webhook/post.go Outdated Show resolved Hide resolved
Copy link

codecov bot commented Mar 20, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

❗ No coverage uploaded for pull request base (main@1809638). Click here to learn what that means.

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main    #1088   +/-   ##
=======================================
  Coverage        ?   62.97%           
=======================================
  Files           ?      347           
  Lines           ?    10564           
  Branches        ?        0           
=======================================
  Hits            ?     6653           
  Misses          ?     3427           
  Partials        ?      484           

@jbrockopp jbrockopp marked this pull request as ready for review March 20, 2024 15:11
@jbrockopp jbrockopp requested a review from a team as a code owner March 20, 2024 15:11
Copy link
Contributor

@ecrupper ecrupper left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks!

@ecrupper ecrupper merged commit 7a6e89a into main Mar 20, 2024
11 of 13 checks passed
@ecrupper ecrupper deleted the fix/api/webhook/build_approval branch March 20, 2024 15:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Indicates a bug
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants