Skip to content
Snippets Groups Projects
Unverified Commit 6a3c4a06 authored by Emanuele Aina's avatar Emanuele Aina Committed by Ritesh Raj Sarraf
Browse files

gitlab-lint: Drop since available tokens are not enough


After the GitLab "Unauthenticated CI lint API may lead to information
disclosure and SSRF" fix shipped with version 13.8.4 the `ci/lint`
endpoints requires authentication but:

1. `$CI_JOB_TOKEN` is not enough
2. `$TEST_GITLAB_AUTH_TOKEN` is not enough either, some extra
   permissions are required

Given that the YAML will get executed in the same pipeline, let's
just drop the lint CI job rather than granting more permissions
than necessary.

Signed-off-by: Emanuele Aina's avatarEmanuele Aina <emanuele.aina@collabora.com>
parent 8fababa1
No related branches found
No related tags found
1 merge request!8backport lint changes
Pipeline #306845 passed
Pipeline: builds-orchestrator

#306846

    ...@@ -65,15 +65,6 @@ stages: ...@@ -65,15 +65,6 @@ stages:
    - docker - docker
    - artifacts - artifacts
    lint-ci:
    stage: test
    tags:
    - lightweight
    image: python
    script:
    - echo "$JOBTEMPLATE" | sed -e "s/@BUILD_ID@/20201225.0000/" | tee test.yml
    - ./tests/gitlab-lint --endpoint "${CI_API_V4_URL}/ci/lint" --yaml test.yml
    prepare: prepare:
    stage: prepare stage: prepare
    tags: tags:
    ......
    #!/usr/bin/env python3
    import argparse
    import json
    import urllib.request
    def validate(endpoint, ci):
    content = open(ci).read()
    data = json.dumps({"content": content}).encode("utf-8")
    headers = {"Content-Type": "application/json"}
    request = urllib.request.Request(
    endpoint, method="POST", data=data, headers=headers
    )
    response = urllib.request.urlopen(request)
    results = json.load(response)
    valid = results["status"] == "valid"
    for e in results["errors"]:
    print("error:", e)
    print("" if valid else "💔", ci, results["status"])
    return valid
    if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="Validate the GitLab CI/CD YAML")
    parser.add_argument(
    "--endpoint",
    type=str,
    required=True,
    help="the API endpoint that does the actual validation",
    )
    parser.add_argument(
    "--yaml", type=str, required=True, help="the YAML to be validated",
    )
    args = parser.parse_args()
    valid = validate(args.endpoint, args.yaml)
    if not valid:
    raise SystemExit(1)
    0% Loading or .
    You are about to add 0 people to the discussion. Proceed with caution.
    Finish editing this message first!
    Please register or to comment