3f3101216e
Independent pipelines ignore requirements for non-live changes because they are not actually executed. However, a user might configure an independent pipeline that requires code review and expect a positive code-review pipeline requirement to be enforced. To ignore it risks executing unreviewed code via dependencies. To correct this, we now enforce pipeline requirements in independent pipelines in the same way as dependent ones. This also adds a new "allow-other-connections" pipeline configuration option which permits users to specify exhaustive pipeline requirements. Change-Id: I6c006f9e63a888f83494e575455395bd534b955f Story: 2010515
30 lines
1.2 KiB
YAML
30 lines
1.2 KiB
YAML
---
|
|
features:
|
|
- |
|
|
A new pipeline attribute,
|
|
:attr:`pipeline.allow-other-connections`, has been added
|
|
to ensure that only changes from connections which
|
|
are mentioned in the pipeline configuration (such as triggers,
|
|
reporters, or pipeline requirements) are enqueued.
|
|
security:
|
|
- |
|
|
Non-live items are now subject to pipeline requirements for
|
|
independent pipelines.
|
|
|
|
Previously, an optimization for independent pipelines skipped
|
|
checking that a change met the pipeline requirements. If an
|
|
independent pipeline is intended only to run reviewed code, this
|
|
could allow running unreviewed code by updating dependent changes.
|
|
|
|
Now both non-live and live items are subject to pipeline
|
|
requirements in all pipeline managers.
|
|
|
|
- |
|
|
The new `allow-other-connections` pipeline configuration option
|
|
may now be used to ensure that only changes from connections which
|
|
are mentioned in the pipeline configuration (such as triggers,
|
|
reporters, or pipeline requirements) are enqueued. This allows
|
|
the construction of a pipeline where, for example, code review
|
|
requirements are strictly enforced, even for dependencies which
|
|
are not normally directly enqueued.
|