Expand environment variables on templates? about drone-slack

[tboerger]

If reading env variables gets enabled it's a potential security issue as even the slack webhook gets injected as environment variable.

[fsouza]

@tboerger yeah I realized that after playing with a wrapper for a little bit. Perhaps if drone could provide a list of parameters that were passed to the deployment, then the plugin could have that in the context when rendering the template.

[Morriz]

/reopen

[Morriz]

Can this be reopened? We have multiple drone installations listening to the same repo, and doing CD. We need to report back which instance was successful. This can only be done by parameterizing. Please allow us to use env vars. We are using drone in a controlled environment and no outside meddling with env can happen.

[tboerger]

That is just for you the case. I would prefer to integrate the new plugin lib for this plugin, than you would get the system env variables into the template without allowing any env variable as a security issue.