c3788d943f
Since /tmp is writable by everybody, a user could precreate /tmp/woodpecker with 777 permissions, allowing them to modify the pipeline while it is being run, or preventing the pipeline from running. And since os.MkdirAll error code wasn't checked, the same attacker could have precreated the directory where the pipeline is executed to mess with the run, allowing code execution under the UID of the agent (who has access to the toke, to communicate with the server, which mean a attacker could inject a fake agent, steal credentials, etc) |
||
|---|---|---|
| .github | ||
| .vscode | ||
| .woodpecker | ||
| agent | ||
| charts | ||
| cli | ||
| cmd | ||
| docker | ||
| docs | ||
| nfpm | ||
| pipeline | ||
| server | ||
| shared | ||
| vendor | ||
| version | ||
| web | ||
| woodpecker-go | ||
| .changelog.yml | ||
| .editorconfig | ||
| .gitignore | ||
| .golangci.yml | ||
| CHANGELOG.md | ||
| CONTRIBUTING.md | ||
| docker-compose.example.yml | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| SECURITY.md | ||
| tools.go | ||
Woodpecker
Woodpecker is a community fork of the Drone CI system.
Support
Please consider to donate and become a backer. 🙏 [Become a backer]
Usage
.woodpecker.yml
- Place your pipeline in a file named
.woodpecker.ymlin your repository - Pipeline steps can be named as you like
- Run any command in the commands section
Build steps are containers
- Define any Docker image as context
- Install the needed tools in custom Docker images, use them as context
Plugins
Woodpecker has official plugins, but you can also use your own.
Documentation
Contribution
Who uses Woodpecker?
Codeberg, the woodpecker project itself, and many others.
Leave a comment if you're using it.
Also consider using the topic WoodpeckerCI in your repository, so others can learn
from your config and use the hashtag #WoodpeckerCI when talking about the project on social media!
Here are some places where people mention Woodpecker:
Stars over time
License
Woodpecker is Apache 2.0 licensed with the source files in this repository having a header indicating which license they are under and what copyrights apply.
Files under the docs/ folder are licensed under Creative Commons Attribution-ShareAlike 4.0 International Public License.