buildkite / feedback

Got feedback? Please let us know!
https://buildkite.com
25 stars 24 forks source link

Feature Request - User Permission Improvement - Trigger Step #442

Open thomasbarton opened 5 years ago

thomasbarton commented 5 years ago

Feature Request: If a user triggers a pipeline and that pipeline has a trigger step for another pipeline that the user doesnt have permission for. Allow the pipeline to run and just fail once the trigger step is reached.

Current Flow: The user triggers the pipeline and it fails at the first step pipeline upload due to the error No pipeline with slug X exists even though it does but the user doesnt have permission for it

Why: We started using some contractors and we dont want them to be able to deploy. Our test pipeline triggers our deploy pipeline upon success. We want the contractors to use the same pipeline to run tests but then never get to the deploy step. Currently they cant run the pipeline at all because it contains a trigger step they dont have access to.

Workaround: i believe we can accomplish this with dynamically generated pipelines but that sounds like a lot of brittle code

Best Case Solution: Currently our trigger deploy step is behind a manual unblock step. It would be AWESOME if builds could be started by a user that doesnt have permissions for a trigger step. But then when a user unblocks a step - that users permissions are used to determine if deploying is allowed.

Example: User A starts pipeline 1. Pipeline 1 has a trigger for Pipeline 2. User A does not have permission for pipeline 2. Users A build of Pipeline 1 starts and is successful up to the Unblock step before trigger Pipeline 2. From this point 2 scenarios can happen.