mirror of
https://github.com/authelia/authelia.git
synced 2026-10-28 09:34:52 +08:00
Amir Zarrinkafsh
be0edabcdb
A pipeline-level `notify` webhook can only send to a URL, so it cannot carry the `X-Buildkite-Token` header the Windmill HTTP route for `buildkite_notification_webhook` now checks. The blocked build notification moves to an organisation-level Notification Service webhook scoped to this pipeline, and the hardcoded steps in the Buildkite interface no longer include the `notify` block, so this copy drops it to match. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
18 lines
709 B
YAML
18 lines
709 B
YAML
# SPDX-FileCopyrightText: 2026 Authelia
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
---
|
|
# This represents the hardcoded pipeline set in Buildkite interface which executes the repo provided dynamic pipeline.
|
|
# It is used to ensure that insecure code from external PR cannot be executed before a maintainers approval, to avoid
|
|
# secret leaks.
|
|
steps:
|
|
# Manual intervention by team required to deploy for forked PRs (prevent secret leakage).
|
|
- block: "Public fork needs approval"
|
|
if: build.pull_request.repository.fork == true
|
|
|
|
# Pipeline for all others (tagged commits/local branches/PRs).
|
|
- label: ":pipeline: Setup Pipeline"
|
|
command: ".buildkite/pipeline.sh | buildkite-agent pipeline upload"
|
|
...
|