mirror of
https://github.com/woodpecker-ci/woodpecker.git
synced 2026-04-15 01:41:56 +00:00
Merge branch 'main' into clarify-secrets-in-docs
This commit is contained in:
6543
@@ -53,7 +53,7 @@ Security is pretty important to us and we want to make sure that no one can stea
|
||||
|
||||
## Migration notes
|
||||
|
||||
There have been a few more breaking changes. [Read more about what you need to do when upgrading!](../docs/migrations#200)
|
||||
There have been a few more breaking changes. [Read more about what you need to do when upgrading!](/migrations#200)
|
||||
|
||||
## New features
|
||||
|
||||
|
||||
@@ -14,6 +14,8 @@ tags: [community, image, podman]
|
||||
|
||||
I run Woodpecker CI with podman backend instead of docker and just figured out how to build images with buildah. Since I couldn't find this anywhere documented, I thought I might as well just share it here.
|
||||
|
||||
<!-- truncate -->
|
||||
|
||||
It's actually pretty straight forward. Here's what my repository structure looks like:
|
||||
|
||||
```bash
|
||||
|
||||
@@ -15,6 +15,8 @@ tags: [community, debug]
|
||||
Sometimes you want to debug a pipeline.
|
||||
Therefore I recently discovered: <https://github.com/ekzhang/sshx>
|
||||
|
||||
<!-- truncate -->
|
||||
|
||||
A simple step like should allow you to debug:
|
||||
|
||||
```yaml
|
||||
|
||||
@@ -14,6 +14,8 @@ tags: [community, image, podman, sigstore, signature]
|
||||
|
||||
This example shows how to build a container image with podman while verifying the base image and signing the resulting image.
|
||||
|
||||
<!-- truncate -->
|
||||
|
||||
The image being pulled uses a keyless signature, while the image being built will be signed by a pre-generated private key.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
@@ -87,4 +87,4 @@ be removed in the next major release:
|
||||
- Use `WOODPECKER_EXPERT_FORGE_OAUTH_HOST` instead of `WOODPECKER_DEV_GITEA_OAUTH_URL` or `WOODPECKER_DEV_OAUTH_HOST`
|
||||
- Deprecated `WOODPECKER_WEBHOOK_HOST` in favor of `WOODPECKER_EXPERT_WEBHOOK_HOST`
|
||||
|
||||
For a full list of deprecations that will be dropped in the `next` major release `3.0.0` (no eta yet), please check the [migrations](/docs/migrations#next) section.
|
||||
For a full list of deprecations that will be dropped in the `next` major release `3.0.0` (no eta yet), please check the [migrations](/migrations#next) section.
|
||||
|
||||
@@ -179,12 +179,6 @@ Woodpecker provides the ability to pass environment variables to individual step
|
||||
|
||||
For more details, check the [environment docs](./50-environment.md).
|
||||
|
||||
### `secrets`
|
||||
|
||||
Woodpecker provides the ability to store named parameters external to the YAML configuration file, in a central secret store. These secrets can be passed to individual steps of the workflow at runtime.
|
||||
|
||||
For more details, check the [secrets docs](./40-secrets.md).
|
||||
|
||||
### `failure`
|
||||
|
||||
Some of the steps may be allowed to fail without causing the whole workflow and therefore pipeline to report a failure (e.g., a step executing a linting check). To enable this, add `failure: ignore` to your step. If Woodpecker encounters an error while executing the step, it will report it as failed but still executes the next steps of the workflow, if any, without affecting the status of the workflow.
|
||||
@@ -610,7 +604,7 @@ For more details check the [matrix build docs](./30-matrix-workflows.md).
|
||||
|
||||
You can set labels for your workflow to select an agent to execute the workflow on. An agent will pick up and run a workflow when **every** label assigned to it matches the agents labels.
|
||||
|
||||
To set additional agent labels, check the [agent configuration options](../30-administration/15-agent-config.md#woodpecker_filter_labels). Agents will have at least four default labels: `platform=agent-os/agent-arch`, `hostname=my-agent`, `backend=docker` (type of the agent backend) and `repo=*`. Agents can use a `*` as a wildcard for a label. For example `repo=*` will match every repo.
|
||||
To set additional agent labels, check the [agent configuration options](../30-administration/15-agent-config.md#woodpecker_agent_labels). Agents will have at least four default labels: `platform=agent-os/agent-arch`, `hostname=my-agent`, `backend=docker` (type of the agent backend) and `repo=*`. Agents can use a `*` as a wildcard for a label. For example `repo=*` will match every repo.
|
||||
|
||||
Workflow labels with an empty value will be ignored.
|
||||
By default, each workflow has at least the `repo=your-user/your-repo-name` label. If you have set the [platform attribute](#platform) for your workflow it will have a label like `platform=your-os/your-arch` as well.
|
||||
|
||||
@@ -11,46 +11,32 @@ Woodpecker provides three different levels to add secrets to your pipeline. The
|
||||
|
||||
## Usage
|
||||
|
||||
### Use secrets in commands
|
||||
You can set a setting or an environment value from secrets using the `from_secret` syntax.
|
||||
|
||||
Secrets are exposed to your pipeline steps and plugins as uppercase environment variables and can therefore be referenced in the commands section of your pipeline,
|
||||
once their usage is declared in the `secrets` section:
|
||||
In this example, the secret named `secret_token` would be passed to the setting named `token`,which will be available in the plugin as environment variable named `PLUGIN_TOKEN` (See [plugins](./51-plugins/20-creating-plugins.md#settings) for details), and to the environment variable `TOKEN_ENV`.
|
||||
|
||||
```diff
|
||||
steps:
|
||||
- name: test
|
||||
- name: 'plugin do stuff'
|
||||
image: publish-plugin
|
||||
+ settings:
|
||||
+ token:
|
||||
+ from_secret: secret_token
|
||||
|
||||
- name: 'some commands using secrets'
|
||||
image: bash
|
||||
commands:
|
||||
+ - echo $some_username
|
||||
+ - echo $SOME_PASSWORD
|
||||
+ secrets: [ some_username, SOME_PASSWORD ]
|
||||
```
|
||||
|
||||
The case of the environment variables is not changed, but secret matching is done case-insensitively. In the example above, `DOCKER_PASSWORD` would also match if the secret is called `docker_password`.
|
||||
|
||||
### Using secrets in non-plugin steps via "environment:"
|
||||
|
||||
You can set an environment value from secrets using the `from_secret` syntax.
|
||||
This way, the secret key and environment variable name can differ.
|
||||
|
||||
```diff
|
||||
steps:
|
||||
- name: test
|
||||
image: bash
|
||||
commands:
|
||||
- env | grep OWN
|
||||
- secrets: [ some_username, SOME_PASSWORD ]
|
||||
- env | grep TOKEN
|
||||
+ environment:
|
||||
+ SOME_OWN_DEFINED_VAR:
|
||||
+ from_secret: some_username
|
||||
+ TOKEN_ENV:
|
||||
+ from_secret: secret_token
|
||||
```
|
||||
|
||||
### Using secrets in plugins-steps via "settings:"
|
||||
|
||||
The `from_secret` syntax also works for settings in any hierarchy.
|
||||
|
||||
:::info Important
|
||||
You cannot use `secrets` or `environment` directly in plugin steps, as this could alter plugin execution. Instead, use the `settings` field for secrets in plugins:
|
||||
You cannot use the deprecated `secrets` or `environment` directly in plugin steps, as this could alter plugin execution.
|
||||
Instead, use the `settings` field for secrets in plugins:
|
||||
|
||||
- It's safer: Plugin settings are a controlled interface for customization.
|
||||
- It's consistent: Plugins define which settings they accept and how to handle them.
|
||||
@@ -100,11 +86,11 @@ Please note parameter expressions are subject to pre-processing. When using secr
|
||||
- name: "echo password"
|
||||
image: bash
|
||||
commands:
|
||||
- - echo ${some_username}
|
||||
- - echo ${SOME_PASSWORD}
|
||||
+ - echo $${some_username}
|
||||
+ - echo $${SOME_PASSWORD}
|
||||
secrets: [ some_username, SOME_PASSWORD ]
|
||||
- - echo ${TOKEN_ENV}
|
||||
+ - echo $${TOKEN_ENV}
|
||||
environment:
|
||||
TOKEN_ENV:
|
||||
from_secret: secret_token
|
||||
```
|
||||
|
||||
### Use in Pull Requests events
|
||||
|
||||
@@ -62,7 +62,9 @@ This is the reference list of all environment variables available to your pipeli
|
||||
| `CI_REPO_CLONE_SSH_URL` | repository SSH clone URL | `git@git.example.com:john-doe/my-repo.git` |
|
||||
| `CI_REPO_DEFAULT_BRANCH` | repository default branch | `main` |
|
||||
| `CI_REPO_PRIVATE` | repository is private | `true` |
|
||||
| `CI_REPO_TRUSTED` | repository is trusted | `false` |
|
||||
| `CI_REPO_TRUSTED_NETWORK` | repository has trusted network access | `false` |
|
||||
| `CI_REPO_TRUSTED_VOLUMES` | repository has trusted volumes access | `false` |
|
||||
| `CI_REPO_TRUSTED_SECURITY` | repository has trusted security access | `false` |
|
||||
| | **Current Commit** | |
|
||||
| `CI_COMMIT_SHA` | commit SHA | `eba09b46064473a1d345da7abf28b477468e8dbd` |
|
||||
| `CI_COMMIT_REF` | commit ref | `refs/heads/main` |
|
||||
|
||||
@@ -42,7 +42,7 @@ Values like this are converted to JSON and then passed to your plugin. In the ex
|
||||
|
||||
### Secrets
|
||||
|
||||
Secrets should be passed as a setting option. Therefore, users should use [`from_secret`](../40-secrets.md#using-secrets-in-non-plugin-steps-via-environment).
|
||||
Secrets should be passed as settings too. Therefore, users should use [`from_secret`](../40-secrets.md#usage).
|
||||
|
||||
## Plugin library
|
||||
|
||||
|
||||
@@ -52,7 +52,7 @@ While normal steps are all about arbitrary code execution, plugins should only a
|
||||
|
||||
That's why there are a few limitations. The workspace base is always mounted at `/woodpecker`, but the working directory is dynamically
|
||||
adjusted accordingly, as user of a plugin you should not have to care about this. Also, you cannot use the plugin together with `commands`
|
||||
or `entrypoint` which will fail. Using `secrets` or `environment` is possible, but in this case, the plugin is internally not treated as plugin
|
||||
or `entrypoint` which will fail. Using `environment` is possible, but in this case, the plugin is internally not treated as plugin
|
||||
anymore. The container then cannot access secrets with plugin filter anymore and the containers won't be privileged without explicit definition.
|
||||
|
||||
## Finding Plugins
|
||||
|
||||
@@ -49,7 +49,7 @@ Woodpecker needs to know its own address. You must therefore provide the public
|
||||
+ - WOODPECKER_HOST=${WOODPECKER_HOST}
|
||||
```
|
||||
|
||||
Woodpecker can also have its port's configured. It uses a separate port for gRPC and for HTTP. The agent performs gRPC calls and connects to the gRPC port.
|
||||
Woodpecker can also have its ports configured. It uses a separate port for gRPC and for HTTP. The agent performs gRPC calls and connects to the gRPC port.
|
||||
They can be configured with `*_ADDR` variables:
|
||||
|
||||
```diff title="docker-compose.yaml"
|
||||
|
||||
@@ -87,4 +87,4 @@ All configuration options can be found via [NixOS Search](https://search.nixos.o
|
||||
|
||||
## Tips and tricks
|
||||
|
||||
There are some resources on how to utilize Woodpecker more effectively with NixOS on the [Awesome Woodpecker](../../92-awesome.md) page, like using the runners nix-store in the pipeline.
|
||||
There are some resources on how to utilize Woodpecker more effectively with NixOS on the [Awesome Woodpecker](/awesome) page, like using the runners nix-store in the pipeline.
|
||||
|
||||
@@ -356,7 +356,7 @@ You should specify the tag of your images too, as this enforces exact matches.
|
||||
|
||||
> Defaults are defined in [shared/constant/constant.go](https://github.com/woodpecker-ci/woodpecker/blob/main/shared/constant/constant.go)
|
||||
|
||||
Plugins witch are trusted to handle the netrc info in clone steps.
|
||||
Plugins which are trusted to handle the netrc info in clone steps.
|
||||
If a clone step use an image not in this list, the netrc will not be injected and an user has to use other methods (e.g. secrets) to clone non public repos.
|
||||
|
||||
You should specify the tag of your images too, as this enforces exact matches.
|
||||
@@ -484,7 +484,7 @@ Specify a configuration service endpoint, see [Configuration Extension](./40-adv
|
||||
|
||||
### `WOODPECKER_FORGE_TIMEOUT`
|
||||
|
||||
> Default: 3s
|
||||
> Default: 5s
|
||||
|
||||
Specify timeout when fetching the Woodpecker configuration from forge. See <https://pkg.go.dev/time#ParseDuration> for syntax reference.
|
||||
|
||||
|
||||
@@ -120,11 +120,14 @@ Configures the path of the agent config file.
|
||||
|
||||
Configures the number of parallel workflows.
|
||||
|
||||
### `WOODPECKER_FILTER_LABELS`
|
||||
### `WOODPECKER_AGENT_LABELS`
|
||||
|
||||
> Default: empty
|
||||
|
||||
Configures labels to filter pipeline pick up. Use a list of key-value pairs like `key=value,second-key=*`. `*` can be used as a wildcard. By default, agents provide three additional labels `platform=os/arch`, `hostname=my-agent` and `repo=*` which can be overwritten if needed. To learn how labels work, check out the [pipeline syntax page](../20-usage/20-workflow-syntax.md#labels).
|
||||
Configures custom labels for the agent, to let workflows filter by it.
|
||||
Use a list of key-value pairs like `key=value,second-key=*`. `*` can be used as a wildcard.
|
||||
By default, agents provide three additional labels `platform=os/arch`, `hostname=my-agent` and `repo=*` which can be overwritten if needed.
|
||||
To learn how labels work, check out the [pipeline syntax page](../20-usage/20-workflow-syntax.md#labels).
|
||||
|
||||
### `WOODPECKER_HEALTHCHECK`
|
||||
|
||||
|
||||
@@ -21,3 +21,49 @@ To automatically execute the migration after the start of the server, the new mi
|
||||
## Constants of official images
|
||||
|
||||
All official default images, are saved in [shared/constant/constant.go](https://github.com/woodpecker-ci/woodpecker/blob/main/shared/constant/constant.go) and must be pinned by an exact tag.
|
||||
|
||||
## Building images locally
|
||||
|
||||
### Server
|
||||
|
||||
```sh
|
||||
### build web component
|
||||
make vendor
|
||||
cd web/
|
||||
pnpm install --frozen-lockfile
|
||||
pnpm build
|
||||
cd ..
|
||||
|
||||
### define the platforms to build for (e.g. linux/amd64)
|
||||
# (the | is not a typo here)
|
||||
export PLATFORMS='linux|amd64'
|
||||
make cross-compile-server
|
||||
|
||||
### build the image
|
||||
docker buildx build --platform linux/amd64 -t username/repo:tag -f docker/Dockerfile.server.multiarch --push .
|
||||
```
|
||||
|
||||
:::info
|
||||
The `cross-compile-server` rule makes use of `xgo`, a go cross-compiler. You need to be on a `amd64` host to do this, as `xgo` is only available for `amd64` (see [xgo#213](https://github.com/techknowlogick/xgo/issues/213)).
|
||||
You can try to use the `build-server` rule instead, however this one fails for some OS (e.g. macOS).
|
||||
:::
|
||||
|
||||
### Agent
|
||||
|
||||
```sh
|
||||
### build the agent
|
||||
make build-agent
|
||||
|
||||
### build the image
|
||||
docker buildx build --platform linux/amd64 -t username/repo:tag -f docker/Dockerfile.agent.multiarch --push .
|
||||
```
|
||||
|
||||
### CLI
|
||||
|
||||
```sh
|
||||
### build the CLI
|
||||
make build-cli
|
||||
|
||||
### build the image
|
||||
docker buildx build --platform linux/amd64 -t username/repo:tag -f docker/Dockerfile.cli.multiarch --push .
|
||||
```
|
||||
|
||||
@@ -50,13 +50,13 @@ const config: Config = {
|
||||
position: 'left',
|
||||
items: [
|
||||
{
|
||||
to: '/docs/next/migrations', // Always point to newest migration guide
|
||||
activeBaseRegex: 'docs/(next/)?migrations',
|
||||
to: '/migrations', // Always point to newest migration guide
|
||||
activeBaseRegex: 'migrations',
|
||||
label: 'Migrations',
|
||||
},
|
||||
{
|
||||
to: '/docs/next/awesome', // Always point to newest awesome list
|
||||
activeBaseRegex: 'docs/(next/)?awesome',
|
||||
to: '/awesome', // Always point to newest awesome list
|
||||
activeBaseRegex: 'awesome',
|
||||
label: 'Awesome',
|
||||
},
|
||||
{
|
||||
@@ -147,7 +147,7 @@ const config: Config = {
|
||||
],
|
||||
},
|
||||
],
|
||||
copyright: `Copyright © ${new Date().getFullYear()} Woodpecker CI. Built with Docusaurus.`,
|
||||
copyright: `Copyright © ${new Date().getFullYear()} Woodpecker Authors. Built with Docusaurus.`,
|
||||
},
|
||||
prism: {
|
||||
theme: themes.github,
|
||||
|
||||
+18
-16
@@ -14,19 +14,19 @@
|
||||
"write-heading-ids": "docusaurus write-heading-ids"
|
||||
},
|
||||
"dependencies": {
|
||||
"@docusaurus/core": "^3.1.0",
|
||||
"@docusaurus/plugin-content-blog": "^3.1.0",
|
||||
"@docusaurus/preset-classic": "^3.1.0",
|
||||
"@easyops-cn/docusaurus-search-local": "^0.44.0",
|
||||
"@mdx-js/react": "^3.0.0",
|
||||
"@docusaurus/core": "^3.5.2",
|
||||
"@docusaurus/plugin-content-blog": "^3.5.2",
|
||||
"@docusaurus/preset-classic": "^3.5.2",
|
||||
"@easyops-cn/docusaurus-search-local": "^0.45.0",
|
||||
"@mdx-js/react": "^3.1.0",
|
||||
"@svgr/webpack": "^8.1.0",
|
||||
"clsx": "^2.1.0",
|
||||
"esbuild-loader": "^4.1.0",
|
||||
"clsx": "^2.1.1",
|
||||
"esbuild-loader": "^4.2.2",
|
||||
"file-loader": "^6.2.0",
|
||||
"prism-react-renderer": "^2.3.1",
|
||||
"prism-react-renderer": "^2.4.0",
|
||||
"react": "^18.3.1",
|
||||
"react-dom": "^18.2.0",
|
||||
"redocusaurus": "^2.0.2",
|
||||
"react-dom": "^18.3.1",
|
||||
"redocusaurus": "^2.1.2",
|
||||
"url-loader": "^4.1.1"
|
||||
},
|
||||
"browserslist": {
|
||||
@@ -42,18 +42,20 @@
|
||||
]
|
||||
},
|
||||
"devDependencies": {
|
||||
"@docusaurus/module-type-aliases": "^3.1.0",
|
||||
"@docusaurus/module-type-aliases": "^3.5.2",
|
||||
"@docusaurus/tsconfig": "3.5.2",
|
||||
"@docusaurus/types": "^3.1.0",
|
||||
"@types/node": "^20.11.30",
|
||||
"@types/react": "^18.2.67",
|
||||
"@docusaurus/types": "^3.5.2",
|
||||
"@types/node": "^20.17.1",
|
||||
"@types/react": "^18.3.12",
|
||||
"@types/react-helmet": "^6.1.11",
|
||||
"@types/react-router-dom": "^5.3.3",
|
||||
"typescript": "^5.4.3"
|
||||
"typescript": "^5.6.3"
|
||||
},
|
||||
"pnpm": {
|
||||
"overrides": {
|
||||
"got": "^14.0.0"
|
||||
"got": "^14.0.0",
|
||||
"path-to-regexp": "^3.3.0",
|
||||
"cookie": "^1.0.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -16,7 +16,7 @@
|
||||
"@tsconfig/docusaurus": "^2.0.3",
|
||||
"@types/node": "^20.12.13",
|
||||
"axios": "^1.7.2",
|
||||
"concurrently": "^8.2.2",
|
||||
"concurrently": "^9.0.0",
|
||||
"isomorphic-dompurify": "^2.11.0",
|
||||
"marked": "^14.0.0",
|
||||
"tslib": "^2.6.2",
|
||||
|
||||
@@ -40,11 +40,6 @@
|
||||
"docs": "https://raw.githubusercontent.com/woodpecker-ci/plugin-extend-env/main/docs.md",
|
||||
"verified": true
|
||||
},
|
||||
{
|
||||
"name": "Block Git changes",
|
||||
"docs": "https://codeberg.org/qwerty287/woodpecker-block-git-changes/raw/branch/main/docs.md",
|
||||
"verified": false
|
||||
},
|
||||
{
|
||||
"name": "Regex check",
|
||||
"docs": "https://codeberg.org/qwerty287/woodpecker-regex-check/raw/branch/main/docs.md",
|
||||
@@ -219,6 +214,11 @@
|
||||
"name": "Docker Tags",
|
||||
"docs": "https://raw.githubusercontent.com/dvjn/woodpecker-docker-tags-plugin/main/docs.md",
|
||||
"verified": false
|
||||
},
|
||||
{
|
||||
"name": "Telegram",
|
||||
"docs": "https://raw.githubusercontent.com/appleboy/drone-telegram/refs/heads/master/DOCS.md",
|
||||
"verified": false
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Generated
+1429
-1557
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,18 @@
|
||||
# About
|
||||
|
||||
Woodpecker has been originally forked from Drone 0.8 as the Drone CI license was changed after the 0.8 release from Apache 2.0 to a proprietary license. Woodpecker is based on this latest freely available version.
|
||||
|
||||
## History
|
||||
|
||||
Woodpecker was originally forked by [@laszlocph](https://github.com/laszlocph) in 2019.
|
||||
|
||||
A few important time points:
|
||||
|
||||
- [`2fbaa56`](https://github.com/woodpecker-ci/woodpecker/commit/2fbaa56eee0f4be7a3ca4be03dbd00c1bf5d1274) is the first commit of the fork, made on Apr 3, 2019.
|
||||
- The first release [v0.8.91](https://github.com/woodpecker-ci/woodpecker/releases/tag/v0.8.91) was published on Apr 6, 2019.
|
||||
- On Aug 27, 2019, the project was renamed to "Woodpecker" ([`630c383`](https://github.com/woodpecker-ci/woodpecker/commit/630c383181b10c4ec375e500c812c4b76b3c52b8)).
|
||||
- The first release under the name "Woodpecker" was published on Sep 9, 2019 ([v0.8.104](https://github.com/woodpecker-ci/woodpecker/releases/tag/v0.8.104)).
|
||||
|
||||
## Differences to Drone
|
||||
|
||||
Woodpecker is a community-focused software that still stay free and open source forever, while Drone is managed by [Harness](https://harness.io/) and published under [Polyform Small Business](https://polyformproject.org/licenses/small-business/1.0.0/) license.
|
||||
@@ -1,47 +1,79 @@
|
||||
# Migrations
|
||||
|
||||
Some versions need some changes to the server configuration or the pipeline configuration files.
|
||||
Some versions need some changes to the server configuration or the pipeline configuration files. If you are an user check the `User migrations` section of an version. As an admin of a Woodpecker server or agent check the `Admin migrations` section.
|
||||
|
||||
## `next`
|
||||
|
||||
:::info
|
||||
This will be the next version of Woodpecker.
|
||||
:::
|
||||
|
||||
## User migrations
|
||||
|
||||
- Removed built-in environment variables:
|
||||
- `CI_COMMIT_URL` use `CI_PIPELINE_FORGE_URL`
|
||||
- `CI_STEP_FINISHED` as empty during execution
|
||||
- `CI_PIPELINE_FINISHED` as empty during execution
|
||||
- `CI_PIPELINE_STATUS` was always `success`
|
||||
- `CI_STEP_STATUS` was always `success`
|
||||
- Set `/woodpecker` as defautl workdir for the **woodpecker-cli** container
|
||||
- Move docker resource limit settings from server into agent configuration
|
||||
- Rename server environment variable `WOODPECKER_ESCALATE` to `WOODPECKER_PLUGINS_PRIVILEGED`
|
||||
- All default privileged plugins (like `woodpeckerci/plugin-docker-buildx`) were removed. Please carefully [re-add those plugins](./30-administration/10-server-config.md#woodpecker_plugins_privileged) you trust and rely on.
|
||||
- `WOODPECKER_DEFAULT_CLONE_IMAGE` got depricated use `WOODPECKER_DEFAULT_CLONE_PLUGIN`
|
||||
- Check trusted-clone- and privileged-plugins by image name and tag (if tag is set)
|
||||
- Set `/woodpecker` as default workdir for the **woodpecker-cli** container
|
||||
- Secret filters for plugins now check against tag if specified
|
||||
- Removed `WOODPECKER_DEV_OAUTH_HOST` and `WOODPECKER_DEV_GITEA_OAUTH_URL` use `WOODPECKER_EXPERT_FORGE_OAUTH_HOST`
|
||||
- Compatibility mode of deprecated `pipeline:`, `platform:` and `branches:` pipeline config options are now removed and pipeline will now fail if still in use.
|
||||
- Removed `steps.[name].group` in favor of `steps.[name].depends_on` (see [workflow syntax](./20-usage/20-workflow-syntax.md#depends_on) to learn how to set dependencies)
|
||||
- Removed `WOODPECKER_ROOT_PATH` and `WOODPECKER_ROOT_URL` config variables. Use `WOODPECKER_HOST` with a path instead
|
||||
- Removed `steps.[name].group` in favor of `steps.[name].depends_on` (see [workflow syntax](/docs/usage/workflow-syntax#depends_on) to learn how to set dependencies)
|
||||
- Pipelines without a config file will now be skipped instead of failing
|
||||
- Removed implicitly defined `regcred` image pull secret name. Set it explicitly via `WOODPECKER_BACKEND_K8S_PULL_SECRET_NAMES`
|
||||
- Removed `includes` and `excludes` support from **event** filter
|
||||
- Removed uppercasing all secret env vars, instead, the value of the `secrets` property is used. [Read more](./20-usage/40-secrets.md#use-secrets-in-commands)
|
||||
- Removed upper-casing all secret env vars, instead, the value of the `secrets` property is used. [Read more](/docs/usage/secrets#usage)
|
||||
- Removed alternative names for secrets, use `environment` with `from_secret`
|
||||
- Removed slice definition for env vars
|
||||
- Removed `environment` filter, use `when.evaluate`
|
||||
- Removed `WOODPECKER_WEBHOOK_HOST` in favor of `WOODPECKER_EXPERT_WEBHOOK_HOST`
|
||||
- Migrated to rfc9421 for webhook signatures
|
||||
- Renamed `start_time`, `end_time`, `created_at`, `started_at`, `finished_at` and `reviewed_at` JSON fields to `started`, `finished`, `created`, `started`, `finished`, `reviewed`
|
||||
- JSON field `trusted` on repo model was changed from boolean to object
|
||||
- Update all webhooks by pressing the "Repair all" button in the admin settings as the webhook token claims have changed
|
||||
- Crons now use standard Linux syntax without seconds
|
||||
- Replaced `configs` object by `netrc` in external configuration APIs
|
||||
- Removed old API routes: `registry/` -> `registries`, `/authorize/token`
|
||||
- Replaced `registry` command with `repo registry` in cli
|
||||
- Deprecated `secrets`, use `environment` with `from_secret`
|
||||
|
||||
## Admin migrations
|
||||
|
||||
- Deprecate `WOODPECKER_FILTER_LABELS` use `WOODPECKER_AGENT_LABELS`
|
||||
- Move docker resource limit settings from server into agent configuration
|
||||
- Rename server environment variable `WOODPECKER_ESCALATE` to `WOODPECKER_PLUGINS_PRIVILEGED`
|
||||
- All default privileged plugins (like `woodpeckerci/plugin-docker-buildx`) were removed. Please carefully [re-add those plugins](/docs/next/administration/server-config#woodpecker_plugins_privileged) you trust and rely on.
|
||||
- `WOODPECKER_DEFAULT_CLONE_IMAGE` got deprecated use `WOODPECKER_DEFAULT_CLONE_PLUGIN`
|
||||
- Check trusted-clone- and privileged-plugins by image name and tag (if tag is set)
|
||||
- Removed `WOODPECKER_DEV_OAUTH_HOST` and `WOODPECKER_DEV_GITEA_OAUTH_URL` use `WOODPECKER_EXPERT_FORGE_OAUTH_HOST`
|
||||
- Removed `WOODPECKER_ROOT_PATH` and `WOODPECKER_ROOT_URL` config variables. Use `WOODPECKER_HOST` with a path instead
|
||||
- Removed implicitly defined `regcred` image pull secret name. Set it explicitly via `WOODPECKER_BACKEND_K8S_PULL_SECRET_NAMES`
|
||||
- Removed slice definition for env vars
|
||||
- Migrated to rfc9421 for webhook signatures
|
||||
- Replaced `configs` object by `netrc` in external configuration APIs
|
||||
- Disallow upgrades from 1.x, upgrade to 2.x first
|
||||
|
||||
## 2.7.2
|
||||
|
||||
To secure your instance, set `WOODPECKER_PLUGINS_PRIVILEGED` to only allow specific versions of the `woodpeckerci/plugin-docker-buildx` plugin, use version 5.0.0 or above. This prevents older, potentially unstable versions from being privileged.
|
||||
|
||||
For example, to allow only version 5.0.0, use:
|
||||
|
||||
```bash
|
||||
WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx:5.0.0
|
||||
```
|
||||
|
||||
To allow multiple versions, you can separate them with commas:
|
||||
|
||||
```bash
|
||||
WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx:5.0.0,woodpeckerci/plugin-docker-buildx:5.1.0
|
||||
```
|
||||
|
||||
This setup ensures only specified, stable plugin versions are given privileged access.
|
||||
|
||||
Read more about it in [#4213](https://github.com/woodpecker-ci/woodpecker/pull/4213)
|
||||
|
||||
## 2.0.0
|
||||
|
||||
- Dropped deprecated `CI_BUILD_*`, `CI_PREV_BUILD_*`, `CI_JOB_*`, `*_LINK`, `CI_SYSTEM_ARCH`, `CI_REPO_REMOTE` built-in environment variables
|
||||
- Deprecated `platform:` filter in favor of `labels:`, [read more](./20-usage/20-workflow-syntax.md#filter-by-platform)
|
||||
- Deprecated `platform:` filter in favor of `labels:`, [read more](/docs/usage/workflow-syntax#filter-by-platform)
|
||||
- Secrets `event` property was renamed to `events` and `image` to `images` as both are lists. The new property `events` / `images` has to be used in the api. The old properties `event` and `image` were removed.
|
||||
- The secrets `plugin_only` option was removed. Secrets with images are now always only available for plugins using listed by the `images` property. Existing secrets with a list of `images` will now only be available to the listed images if they are used as a plugin.
|
||||
- Removed `build` alias for `pipeline` command in CLI
|
||||
@@ -53,8 +85,8 @@ Some versions need some changes to the server configuration or the pipeline conf
|
||||
|
||||
## 1.0.0
|
||||
|
||||
- The signature used to verify extension calls (like those used for the [config-extension](./30-administration/40-advanced/100-external-configuration-api.md)) done by the Woodpecker server switched from using a shared-secret HMac to an ed25519 key-pair. Read more about it at the [config-extensions](./30-administration/40-advanced/100-external-configuration-api.md) documentation.
|
||||
- Refactored support for old agent filter labels and expressions. Learn how to use the new [filter](./20-usage/20-workflow-syntax.md#labels)
|
||||
- The signature used to verify extension calls (like those used for the [config-extension](/docs/administration/advanced/external-configuration-api)) done by the Woodpecker server switched from using a shared-secret HMac to an ed25519 key-pair. Read more about it at the [config-extensions](/docs/administration/advanced/external-configuration-api) documentation.
|
||||
- Refactored support for old agent filter labels and expressions. Learn how to use the new [filter](/docs/usage/workflow-syntax#labels)
|
||||
- Renamed step environment variable `CI_SYSTEM_ARCH` to `CI_SYSTEM_PLATFORM`. Same applies for the cli exec variable.
|
||||
- Renamed environment variables `CI_BUILD_*` and `CI_PREV_BUILD_*` to `CI_PIPELINE_*` and `CI_PREV_PIPELINE_*`, old ones are still available but deprecated
|
||||
- Renamed environment variables `CI_JOB_*` to `CI_STEP_*`, old ones are still available but deprecated
|
||||
@@ -63,7 +95,7 @@ Some versions need some changes to the server configuration or the pipeline conf
|
||||
- Renamed API endpoints for pipelines (`<owner>/<repo>/builds/<buildId>` -> `<owner>/<repo>/pipelines/<pipelineId>`), old ones are still available but deprecated
|
||||
- Updated Prometheus gauge `build_*` to `pipeline_*`
|
||||
- Updated Prometheus gauge `*_job_*` to `*_step_*`
|
||||
- Renamed config env `WOODPECKER_MAX_PROCS` to `WOODPECKER_MAX_WORKFLOWS` (still available as fallback)
|
||||
- Renamed config env `WOODPECKER_MAX_PROCS` to `WOODPECKER_MAX_WORKFLOWS` (still available as fallback) <!-- cspell:ignore PROCS -->
|
||||
- The pipelines are now also read from `.yaml` files, the new default order is `.woodpecker/*.yml` and `.woodpecker/*.yaml` (without any prioritization) -> `.woodpecker.yml` -> `.woodpecker.yaml`
|
||||
- Dropped support for [Coding](https://coding.net/), [Gogs](https://gogs.io) and Bitbucket Server (Stash).
|
||||
- `/api/queue/resume` & `/api/queue/pause` endpoint methods were changed from `GET` to `POST`
|
||||
@@ -92,7 +124,7 @@ Some versions need some changes to the server configuration or the pipeline conf
|
||||
|
||||
Only projects created after updating will have an empty value by default. Existing projects will stick to the current pipeline path which is `.drone.yml` in most cases.
|
||||
|
||||
Read more about it at the [Project Settings](./20-usage/75-project-settings.md#pipeline-path)
|
||||
Read more about it at the [Project Settings](/docs/usage/project-settings#pipeline-path)
|
||||
|
||||
- From version `0.15.0` ongoing there will be three types of docker images: `latest`, `next` and `x.x.x` with an alpine variant for each type like `latest-alpine`.
|
||||
If you used `latest` before to try pre-release features you should switch to `next` after this release.
|
||||
@@ -127,7 +159,7 @@ Some versions need some changes to the server configuration or the pipeline conf
|
||||
- CI_SOURCE_BRANCH => use CI_COMMIT_SOURCE_BRANCH
|
||||
- CI_TARGET_BRANCH => use CI_COMMIT_TARGET_BRANCH
|
||||
|
||||
For all available variables and their descriptions have a look at [built-in-environment-variables](./20-usage/50-environment.md#built-in-environment-variables).
|
||||
For all available variables and their descriptions have a look at [built-in-environment-variables](/docs/usage/environment#built-in-environment-variables).
|
||||
|
||||
- Prometheus metrics have been changed from `drone_*` to `woodpecker_*`
|
||||
|
||||
@@ -19,7 +19,7 @@ the actual release will be about a week later.
|
||||
|
||||
### Deprecations & migrations
|
||||
|
||||
All deprecations and migrations for Woodpecker users and instance admins are documented in the [migration guide](/docs/next/migrations).
|
||||
All deprecations and migrations for Woodpecker users and instance admins are documented in the [migration guide](/migrations).
|
||||
|
||||
## Next version (current state of the `main` branch)
|
||||
|
||||
@@ -33,7 +33,11 @@ Here you can find documentation for previous versions of Woodpecker.
|
||||
|
||||
| | | |
|
||||
| ------- | ---------- | ------------------------------------------------------------------------------------- |
|
||||
| 2.6.0 | 2024-07-18 | [Documentation](https://github.com/woodpecker-ci/woodpecker/tree/v2.6.0/docs/docs/) |
|
||||
| 2.7.2 | 2024-11-03 | [Documentation](https://github.com/woodpecker-ci/woodpecker/tree/v2.7.2/docs/docs/) |
|
||||
| 2.7.1 | 2024-09-07 | [Documentation](https://github.com/woodpecker-ci/woodpecker/tree/v2.7.1/docs/docs/) |
|
||||
| 2.7.0 | 2024-07-18 | [Documentation](https://github.com/woodpecker-ci/woodpecker/tree/v2.7.0/docs/docs/) |
|
||||
| 2.6.1 | 2024-07-19 | [Documentation](https://github.com/woodpecker-ci/woodpecker/tree/v2.6.1/docs/docs/) |
|
||||
| 2.6.0 | 2024-06-13 | [Documentation](https://github.com/woodpecker-ci/woodpecker/tree/v2.6.0/docs/docs/) |
|
||||
| 2.5.0 | 2024-06-01 | [Documentation](https://github.com/woodpecker-ci/woodpecker/tree/v2.5.0/docs/docs/) |
|
||||
| 2.4.1 | 2024-03-20 | [Documentation](https://github.com/woodpecker-ci/woodpecker/tree/v2.4.1/docs/docs/) |
|
||||
| 2.4.0 | 2024-03-19 | [Documentation](https://github.com/woodpecker-ci/woodpecker/tree/v2.4.0/docs/docs/) |
|
||||
|
||||
Reference in New Issue
Block a user