Preempt future Woodpecker schema hard-fail: move plugin secrets to settings.*.from_secret #24

New Issue

2026-07-09T20:41:49+03:00

repo-worker commented

2026-07-09 20:41:49 +03:00

Not blocking. Forward-looking cleanup surfaced during the oleks/ci-scripts#19 flake-hub canary (oleks/cluster#224 capacity incident, unrelated).

Context: every thin pipeline step (both the fleet family in render_thin_fleet.py and the quartet single/split additions in render_thin_quartet.py) declares environment: for token secrets (REGISTRY_TOKEN, ATTIC_TOKEN, GITEA_CLONE_TOKEN) alongside settings: (run, flow, cache, etc.) on the same step. Woodpecker's linter flags this: "Should not configure both 'environment' and 'settings'" plus a schema warning "Additional property settings is not allowed".

Verified NOT currently broken (source-read against woodpecker-ci/woodpecker@main, matching our 3.15 server):

pipeline/frontend/yaml/compiler/convert.go's createProcess() calls settings.ParamsToEnv(container.Settings, ..., "PLUGIN_", ...) and settings.ParamsToEnv(container.Environment, ..., "", ...) unconditionally — no IsPlugin() gate on either. Both secrets and PLUGIN_* settings reliably reach the container today.
pipeline/frontend/yaml/linter/linter.go's lintSettings(): commands+settings and entrypoint+settings are hard errors; environment+settings is explicitly newLinterError(..., true) — is_warning: true by design, a deliberate soft advisory.
The one real caveat the docs mention (losing "plugin secret filter" access when environment: is present) is inert: server/store/datastore/migration/004_remove_secrets_plugin_only_col.go dropped that DB column entirely years ago.

Why this is still worth doing eventually: the schema-validation warning comes from lintSchema(), and the source has this exact comment at the call site: // TODO: let pipelines fail if the schema is invalid. A future Woodpecker upgrade could turn today's soft warning into a hard pipeline failure with no notice beyond a changelog entry.

Proposed migration (not urgent, do in one pass across BOTH families):

Move secrets fully into settings:, e.g. settings: { attic_token: { from_secret: attic_token } } → arrives in the container as PLUGIN_ATTIC_TOKEN.
Update entrypoint.sh to read PLUGIN_ATTIC_TOKEN / PLUGIN_REGISTRY_TOKEN / PLUGIN_GITEA_CLONE_TOKEN first, falling back to the bare ATTIC_TOKEN / REGISTRY_TOKEN / GITEA_CLONE_TOKEN names for compatibility during rollover.
Update render_thin_fleet.py and render_thin_quartet.py to emit the new settings:-only shape, dropping environment: entirely from thin steps.
Needs a plugin version bump (coordinate with whichever change lands tag_strip_v/image_name — no need for a separate republish).
Re-render and diff all fleet + quartet repos before any push, same discipline as #19.

Acceptance:

entrypoint.sh reads PLUGIN_*-prefixed secret names with bare-name fallback.
Both generators emit settings:-only steps (no environment: for secrets).
Plugin republished under a new tag; wiki Spec/Fleet-Publish-Plugin-System updated.
Re-rendered + diffed across every fleet and quartet repo, no behavior change beyond the env-var delivery mechanism.

Not a prerequisite for any in-flight canary — the current design is confirmed safe on 3.15.

**Not blocking.** Forward-looking cleanup surfaced during the oleks/ci-scripts#19 flake-hub canary (oleks/cluster#224 capacity incident, unrelated). **Context:** every thin pipeline step (both the fleet family in `render_thin_fleet.py` and the quartet single/split additions in `render_thin_quartet.py`) declares `environment:` for token secrets (`REGISTRY_TOKEN`, `ATTIC_TOKEN`, `GITEA_CLONE_TOKEN`) alongside `settings:` (`run`, `flow`, `cache`, etc.) on the same step. Woodpecker's linter flags this: `"Should not configure both 'environment' and 'settings'"` plus a schema warning `"Additional property settings is not allowed"`. **Verified NOT currently broken** (source-read against woodpecker-ci/woodpecker@main, matching our 3.15 server): - `pipeline/frontend/yaml/compiler/convert.go`'s `createProcess()` calls `settings.ParamsToEnv(container.Settings, ..., "PLUGIN_", ...)` and `settings.ParamsToEnv(container.Environment, ..., "", ...)` **unconditionally** — no `IsPlugin()` gate on either. Both secrets and `PLUGIN_*` settings reliably reach the container today. - `pipeline/frontend/yaml/linter/linter.go`'s `lintSettings()`: `commands`+`settings` and `entrypoint`+`settings` are hard errors; `environment`+`settings` is explicitly `newLinterError(..., true)` — `is_warning: true` by design, a deliberate soft advisory. - The one real caveat the docs mention (losing "plugin secret filter" access when `environment:` is present) is inert: `server/store/datastore/migration/004_remove_secrets_plugin_only_col.go` dropped that DB column entirely years ago. **Why this is still worth doing eventually:** the schema-validation warning comes from `lintSchema()`, and the source has this exact comment at the call site: `// TODO: let pipelines fail if the schema is invalid`. A future Woodpecker upgrade could turn today's soft warning into a hard pipeline failure with no notice beyond a changelog entry. **Proposed migration (not urgent, do in one pass across BOTH families):** - Move secrets fully into `settings:`, e.g. `settings: { attic_token: { from_secret: attic_token } }` → arrives in the container as `PLUGIN_ATTIC_TOKEN`. - Update `entrypoint.sh` to read `PLUGIN_ATTIC_TOKEN` / `PLUGIN_REGISTRY_TOKEN` / `PLUGIN_GITEA_CLONE_TOKEN` first, falling back to the bare `ATTIC_TOKEN` / `REGISTRY_TOKEN` / `GITEA_CLONE_TOKEN` names for compatibility during rollover. - Update `render_thin_fleet.py` and `render_thin_quartet.py` to emit the new `settings:`-only shape, dropping `environment:` entirely from thin steps. - Needs a plugin version bump (coordinate with whichever change lands `tag_strip_v`/`image_name` — no need for a separate republish). - Re-render and diff all fleet + quartet repos before any push, same discipline as #19. **Acceptance:** - [ ] `entrypoint.sh` reads `PLUGIN_*`-prefixed secret names with bare-name fallback. - [ ] Both generators emit `settings:`-only steps (no `environment:` for secrets). - [ ] Plugin republished under a new tag; wiki Spec/Fleet-Publish-Plugin-System updated. - [ ] Re-rendered + diffed across every fleet and quartet repo, no behavior change beyond the env-var delivery mechanism. Not a prerequisite for any in-flight canary — the current design is confirmed safe on 3.15.

repo-worker added this to the Modern CI Phase 2+3 milestone 2026-07-09 20:41:49 +03:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: oleks/ci-scripts#24