Set scope for secrets #9998

New Issue

GiteaMirror · 2025-11-02T08:55:19-06:00

GiteaMirror commented

2025-11-02 08:55:19 -06:00

Originally created by @JakobDev on GitHub (Dec 20, 2022).

Feature Description

Gitea has now secrets that will be used by the upcoming Actions. It makes sense, to let the User limit the Scope where these Secrets are actually available (on a Pipeline triggered by a Push/PR etc.)

Screenshots

Something like Woodpecker does:

Originally created by @JakobDev on GitHub (Dec 20, 2022). ### Feature Description Gitea has now secrets that will be used by the upcoming Actions. It makes sense, to let the User limit the Scope where these Secrets are actually available (on a Pipeline triggered by a Push/PR etc.) ### Screenshots Something like Woodpecker does: ![grafik](https://user-images.githubusercontent.com/15185051/208696670-035be171-481a-4611-a7ad-af6806903013.png)

GiteaMirror added the type/proposal type/feature labels 2025-11-02 08:55:19 -06:00

GiteaMirror commented

2025-11-02 08:55:19 -06:00

@delvh commented on GitHub (Dec 20, 2022):

Hmm, do we really need this?
If not even GitHub or GitLab support it, is there really such a huge value in adding it?
This heavily complicates the logic, and I don't think you typically need that fine-grained separation.
I personally am rather against it.

@delvh commented on GitHub (Dec 20, 2022): Hmm, do we **really** need this? If not even GitHub or GitLab support it, is there really such a huge value in adding it? This heavily complicates the logic, and I don't think you typically need that fine-grained separation. I personally am rather against it.

GiteaMirror commented

2025-11-02 08:55:20 -06:00

@markkrj commented on GitHub (Dec 20, 2022):

This makes sense, as secrets can be exposed by malicious code in PRs. Gitea also has protected tags and branches, so it makes sense for those as well. GitHub does not allow use of secrets on PRs by default. Only on workflows triggered by specific event (pull_request_target). Does GitLab even has a built-in secret storage? I could not find. They have instructions on how to use Vault as a secret storage for its CI, and it allows for even more granularity than just refs.

@markkrj commented on GitHub (Dec 20, 2022): This makes sense, as secrets can be exposed by malicious code in PRs. Gitea also has protected tags and branches, so it makes sense for those as well. GitHub does not allow use of secrets on PRs by default. Only on workflows triggered by specific event (pull_request_target). Does GitLab even has a built-in secret storage? I could not find. They have instructions on how to use Vault as a secret storage for its CI, and it allows for even more granularity than just refs.

GiteaMirror commented

2025-11-02 08:55:20 -06:00

@KN4CK3R commented on GitHub (Dec 22, 2022):

Github does have different "scopes": Actions, Codespaces, Dependabot
If we want to use the secrets for internal logic like mirror credentials we will need different types too.

@KN4CK3R commented on GitHub (Dec 22, 2022): Github does have different "scopes": Actions, Codespaces, Dependabot If we want to use the secrets for internal logic like mirror credentials we will need different types too.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9998