github/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2026-04-15 01:41:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

add info not

Browse Source
This commit is contained in:
6543
2024-10-02 21:43:26 +01:00
parent bd0b40b439
commit 58d7dec387
1 changed files with 23 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
docs/docs/20-usage/40-secrets.md
View File

@@ -47,22 +47,31 @@ This way, the secret key and environment variable name can differ.
### Using secrets in plugins-steps via "settings:"
The `from_secret` syntax also work for settings in any hierarchy.
Note that you can not use `secrets` and also not use it with `environment`, as this could alter the execution of plugins and so it is forbidden by the linter now.
The `from_secret` syntax also works for settings in any hierarchy.
In the below example, the secret `SURGE_TOKEN` would be passed to the setting named `surge_token`, which again will be available in the plugin as environment variable named `PLUGIN_SURGE_TOKEN` (See [plugins](./51-plugins/20-creating-plugins.md#settings) for details).
:::info Important
You cannot use `secrets` or `environment` directly in plugin steps, as this could alter plugin execution. Instead, use the `settings` field for secrets in plugins:
```diff
steps:
- name: deploy-preview:
image: woodpeckerci/plugin-surge-preview
settings:
path: 'docs/build/'
+ surge_token:
+ from_secret: SURGE_TOKEN
- It's safer: Plugin settings are a controlled interface for customization.
- It's consistent: Plugins define which settings they accept and how to handle them.
- It maintains security: This approach doesn't compromise the plugin's integrity or security model.
This restriction is enforced by the linter to ensure plugin safety and predictable behavior.
:::
In the example below, the secret `SURGE_TOKEN` would be passed to the setting named `surge_token`, which will be available in the plugin as an environment variable named `PLUGIN_SURGE_TOKEN` (See [plugins](./51-plugins/20-creating-plugins.md#settings) for details).
```yaml
steps:
- name: deploy-preview:
image: woodpeckerci/plugin-surge-preview
settings:
path: 'docs/build/'
surge_token:
from_secret: SURGE_TOKEN
```
As settings can have complex structures, `from_secret` is supported any:
As settings can have complex structures, `from_secret` is supported at any level:
```yaml
steps:
@@ -80,6 +89,8 @@ steps:
- "value3"
```
This approach allows for flexible and secure use of secrets within plugin settings while maintaining the integrity and security of the plugin execution environment.
### Note about parameter pre-processing
Please note parameter expressions are subject to pre-processing. When using secrets in parameter expressions they should be escaped.