Action filter for secrets #13548

New Issue

GiteaMirror · 2025-11-02T10:45:44-06:00

GiteaMirror commented

2025-11-02 10:45:44 -06:00

Originally created by @mclei-asw on GitHub (Sep 30, 2024).

Feature Description

Woodpecker CI has a great feature: Image filter
Its description is:
To prevent abusing your secrets from malicious usage, you can limit a secret to a list of images. If enabled they are not available to any other plugin (steps without user-defined commands). If you or an attacker defines explicit commands, the secrets will not be available to the container to prevent leaking them.

It would be great to have such filter for secrets in Gitea Actions. Just here it should filters "actions" name or URL.
In Woodpecker each action is provided by an image, that's why the name should be different.

It will allow to expose secrets for only limited list of actions. For example, as Gitea does not provide any support for cloning other repositories than it is actually run on, we can grant access to a specific user and allow its secret to be used only by the specific clone action. And nobody can maliciously reveal that secret.

Screenshots

No response

Originally created by @mclei-asw on GitHub (Sep 30, 2024). ### Feature Description Woodpecker CI has a great feature: [Image filter](https://woodpecker-ci.org/docs/usage/secrets#image-filter) Its description is: _To prevent abusing your secrets from malicious usage, you can limit a secret to a list of images. If enabled they are not available to any other plugin (steps without user-defined commands). If you or an attacker defines explicit commands, the secrets will not be available to the container to prevent leaking them._ It would be great to have such filter for secrets in Gitea Actions. Just here it should filters "actions" name or URL. In Woodpecker each action is provided by an image, that's why the name should be different. It will allow to expose secrets for only limited list of actions. For example, as Gitea does not provide any support for cloning other repositories than it is actually run on, we can grant access to a specific user and allow its secret to be used only by the specific clone action. And nobody can maliciously reveal that secret. ### Screenshots _No response_

GiteaMirror added the topic/gitea-actions type/proposal labels 2025-11-02 10:45:44 -06:00

GiteaMirror commented

2025-11-02 10:45:45 -06:00

@lunny commented on GitHub (Oct 1, 2024):

Maybe It should filter both container/image and actions.

@lunny commented on GitHub (Oct 1, 2024): Maybe It should filter both container/image and actions.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13548