Hey there :wave: I am creating a pipeline for a public repo that I’d like to trigger pull requests from 3rd party forks. The option below is nice and allows me to trigger builds from any 3rd-party fork. [image] Coming from Jenkins and GitHub actions, I assumed there would be a way to use the .bu…

Just for the sake of closing this thread. This is my first pass at a plugin GitHub - nickofthyme/pull-request-protector-buildkite-plugin: Blocks 3rd-party pull requests based on user checks and files changed . Example use would be something like… steps: - label: "Check user" key: auth-check …

I’ve been experimenting with this approach recently: --- steps: - block: ':hourglass: Waiting for Grapl Engineer...' prompt: | Does this external contribution look safe to run? If so, please unblock it! If not, please cancel this pipeline run altogether. if: build.pull_request.repos…

Yeah that would work but would require approval for everyone, including repo owners. Maybe this combined with a check for files in .buidkite/ would be adequate security with maximum flexibility.

Yeah, this works for us because everyone at my company works directly on the main repository and doesn’t use forks. If you all have an “everybody uses forks” policy, this won’t be what you want. :slightly_frowning_face:

You could maybe set up the "check for files in .buildkite/" logic you mentioned in a script that you include on all your build agents, and then use that in a preliminary, pre-upload step in a UI-defined pipeline. Packaging it up in a plugin would be another, more flexible, approach to take.

Yeah we use the fork-and-branch git workflow. It’d be nice if there was a way to specify a ref for the pipeline upload similar to GitHub actions reusable workflows with the {owner}/{repo}@{ref} syntax… # GitHub action syntax -- not buildkite! jobs: call-workflow-1-in-local-repo: uses: octo-o…

Interesting idea… might be worth dropping a post in the Features category !

Yeah but even though the pipeline upload is using protected source, how would the uploaded steps use the protected .buildkite/ source for running each job? Surely this has come up before for others :sweat_smile:. Thanks for the ideas!

Hey @nickofthyme welcome to the community! :wave: @cwmaier-grapl ’s suggestion of using a hook or packaging up a script in a plugin to run some checks would be one way of handling the behaviour you are looking for. I think though, the feature request you created is an excellent suggestion, and I’ve …

Yeah working on a plugin now to check user membership, etc to determine when to block the pipeline, thanks for the comment!

Run pipeline from protected branch

General

nickofthyme April 29, 2022, 6:31pm 9

Not sure how far it will go but I started the conversation! Run pipelines based on protected ref

Topic		Replies	Views
Run pipelines based on protected ref Features Requests	1	299	April 29, 2022
Public Build Security on PRs General	11	2116	July 18, 2021
How to best handle builds from forks? General	8	619	May 18, 2023
Limit PR build triggers by allow list, in addition to branch name Features Requests	4	1094	October 16, 2020
Building a forked private Pull Request General	3	821	May 2, 2022

Run pipeline from protected branch

Related topics