Protection rules per environment (settings, not only the pipeline's approval block) issue #62
open andymccall opened this · 0 comments
andymccall
oxygenflow#59 made the approval block the environment's protection: a job's token names its environment only once it was approved. What issue #59 also asked: protection rules per environment kept by the hub, so a pipeline cannot weaken them: for each environment of a repository, which bookmarks may deploy, the least role that approves, whether the pusher may approve, a wait timer; enforced at claim whatever the pipeline says (a job for a protected environment with no approval block waits anyway). Settings > Environments, and in the API.
oxygenflow#59 made the approval block the environment's protection: a job's token names its environment only once it was approved. What issue #59 also asked: protection rules per environment kept by the hub, so a pipeline cannot weaken them: for each environment of a repository, which bookmarks may deploy, the least role that approves, whether the pusher may approve, a wait timer; enforced at claim whatever the pipeline says (a job for a protected environment with no approval block waits anyway). Settings > Environments, and in the API.