{"action":"created","issue":{"url":"https://api.github.com/repos/drone/drone/issues/894","labels_url":"https://api.github.com/repos/drone/drone/issues/894/labels{/name}","comments_url":"https://api.github.com/repos/drone/drone/issues/894/comments","events_url":"https://api.github.com/repos/drone/drone/issues/894/events","html_url":"https://github.com/drone/drone/issues/894","id":58551077,"number":894,"title":"Allow environment variables to be set on build basis + ondemand builds","user":{"login":"themihai","id":1800192,"avatar_url":"https://avatars.githubusercontent.com/u/1800192?v=3","gravatar_id":"","url":"https://api.github.com/users/themihai","html_url":"https://github.com/themihai","followers_url":"https://api.github.com/users/themihai/followers","following_url":"https://api.github.com/users/themihai/following{/other_user}","gists_url":"https://api.github.com/users/themihai/gists{/gist_id}","starred_url":"https://api.github.com/users/themihai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/themihai/subscriptions","organizations_url":"https://api.github.com/users/themihai/orgs","repos_url":"https://api.github.com/users/themihai/repos","events_url":"https://api.github.com/users/themihai/events{/privacy}","received_events_url":"https://api.github.com/users/themihai/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-23T07:26:46Z","updated_at":"2015-02-23T08:18:09Z","closed_at":null,"body":"I would like to propose a feature and also to offer my help to implement/develop it if it is accepted. The feature is important for organisations with many repositories and many teams. It addresses the security of environment variables.\r\nFeature:\r\n  Allow the client to run builds on arbitrary branches/commits with specific environment variables so that it doesn't need to expose secrets in config files or web ui.\r\n\r\nExample:\r\n``curl -X POST https://drone.io/api/repos/github.com/foo/bar/run?branch=develop&env[0]=[secret_name=secret_value]``\r\n  A CLI could be used to automate this kind of request(e.g. run it from the current branch and it picks up the branch and repository) so you may need just one more command after push. \r\nThe command above would run a new build using the latest changes of the develop branch with a secret set as environment variable(secret_name=secret_value). I find this transparent and more secure than defining the secrets in config files or the web UI. \r\nUse case:\r\n   Many projects require external dependencies during the build process. An example is a go project which imports many other repositories/packages. The external dependencies have specific access restrictions (e.g. only some developers have access to them). The develop has no problem to download these dependencies locally because it's supposed to already have access to them (though github teams ACL or whatever). However on the build server various secrets/tokens are required(tokens, password etc). \r\nThe current practice is to simply define the secrets/tokens as environment variables. Usually the token is global because the tokens management becomes laborious as the number of dependencies and repositories increases. This presents a great security risk because a rough team member(or someone who hacked the account)  with access to a small repository within the organisation could simply commit code to print the secrets/tokens in the build log and use them to access restricted dependencies. This may even go unnoticed because it may commit the code in an unmonitored branch so the change/build is not reviewed.\r\n  Another issue is that even if you would set a different secret/token for each repository(unfeasible)  there is still the risk for someone who leaves the team to use the secrets later when its access was restricted. It's not feasible to change all the tokens whenever someone leaves a specific team.  \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/drone/drone/issues/comments/75503985","html_url":"https://github.com/drone/drone/issues/894#issuecomment-75503985","issue_url":"https://api.github.com/repos/drone/drone/issues/894","id":75503985,"user":{"login":"bradrydzewski","id":817538,"avatar_url":"https://avatars.githubusercontent.com/u/817538?v=3","gravatar_id":"","url":"https://api.github.com/users/bradrydzewski","html_url":"https://github.com/bradrydzewski","followers_url":"https://api.github.com/users/bradrydzewski/followers","following_url":"https://api.github.com/users/bradrydzewski/following{/other_user}","gists_url":"https://api.github.com/users/bradrydzewski/gists{/gist_id}","starred_url":"https://api.github.com/users/bradrydzewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradrydzewski/subscriptions","organizations_url":"https://api.github.com/users/bradrydzewski/orgs","repos_url":"https://api.github.com/users/bradrydzewski/repos","events_url":"https://api.github.com/users/bradrydzewski/events{/privacy}","received_events_url":"https://api.github.com/users/bradrydzewski/received_events","type":"User","site_admin":false},"created_at":"2015-02-23T08:18:09Z","updated_at":"2015-02-23T08:18:09Z","body":"@themgt thanks for clarifying. We are working on a few changes that I think will start to address this:\r\n\r\nFirst, we are going to use a separate container to clone all repository data into a volume. We just started working on this, early code here: https://github.com/drone/drone-clone-git\r\n\r\nSecond, we are going to use separate containers to execute all plugins. Plugin containers will link directly to the same volume mentioned above. So you could imagine an S3 container that has access to the volume in order to upload artifacts to S3.\r\n\r\nBoth the above changes are important because we no longer need to pass the environment variables directly to the build container. This would (for example) prevent a malicious team member from dumping secret data to the logs.\r\n\r\nThird, for some plugins we allow you to set global configuration data in the `drone.toml` configuration file. This isn't available for all plugins, but we are doing this with the `npm` plugin:\r\nhttps://github.com/drone/drone/blob/master/plugin/publish/npm/npm.go#L43\r\n\r\nThere are still edge cases that need to be considered, but I think we are definitely taking steps in the right direction."}}