aoldershaw / manual-trigger-guard

Concourse resource type to restrict who can manually trigger jobs

manual-trigger-guard

A Concourse resource type to fail a build when it is triggered by a user that is not granted access (via GitHub username or team membership).

Usage

resource_types:
- name: manual-trigger-guard
  type: registry-image
  source: {repository: aoldershaw/manual-trigger-guard}

resources:
- name: allow-maintainers-guard
  type: manual-trigger-guard
  expose_build_created_by: true
  source:
    access_token: ((access_token))
    users:
    - some-user
    teams:
    - concourse/maintainers

jobs:
- name: some-job
  plan:
  - put: allow-maintainers-guard
  - ... # the rest of the job plan

With this configuration, some-job must be triggered manually, and the build will fail if it is triggered by a user other than some-user or one of the members of concourse/maintainers.

Note: the access_token must be specified if using the teams configuration, and the access token must be granted the read:org permission. The access token must belong to a user that has visibility to the teams.

manual-trigger-guard's Issues

need to add api endpoint for github enterprise

This resource is cool, but the problem was it is by default using the normal github api https://api.github.com
It will be nice if this resource supports github enterprise API as well like this resource https://github.com/telia-oss/github-pr-resource
We can pass the enterprise github v3 endpoint in the pipeline, so it checks there instead of default endpoint