\n\nThis is inconsistent with how secrets are handled elsewhere in Woodpecker:\n\nIn the Secrets section, users cannot view secret values (they can only update them).\n\nIn the Forge edit form, the OAuth Client Secret is already hidden by default.\n\n### Suggested solution\n\nIt would be preferable if the Git password field in the Forge UI were also hidden (like secrets), so that even Woodpecker admins cannot view these values in plaintext once they are saved.\n\n### Alternative\n\n_No response_\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Checked that the feature isn't part of the `next` version already [https://woodpecker-ci.org/versions]\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3164],{"name":3140,"color":3141},5471,"Hide Bitbucket Data Center credentials in Forge UI","2025-08-31T10:17:07Z","https://github.com/woodpecker-ci/woodpecker/issues/5471",0.7697826,{"description":3171,"labels":3172,"number":3179,"owner":3143,"repository":3144,"state":3180,"title":3181,"updated_at":3182,"url":3183,"score":3184},"### Clear and concise description of the problem\r\n\r\nWhen using the Woodpecker CLI's `exec` (sub)command to execute a pipeline locally, having one or more secrets required in the pipeline causes the entire pipeline to fail to execute. There doesn't appear to be a way to supply any local secrets or retrieve secrets from the server either.\r\n\r\n### Suggested solution\r\n\r\nIn my opinion it would make sense for there to be a `--secret` option/switch for the `exec` command that allows supplying secret values locally. That way, downloading from private registries or uploading a release would also be possible locally.\r\n\r\n### Alternative\r\n\r\nCommenting out the parts that require secrets seems to be the only way to run a pipeline using `exec` currently, but obviously that causes steps that require secrets to fail.\r\n\r\n### Additional context\r\n\r\nI talked to 6543 to make sure that I wasn't missing something obvious, and they agreed that, if this feature is not present already (which it doesn't appear to be!), it's something that would be good to have.\r\n\r\nAlso, this is the exact error message that is displayed right at the start of the pipeline and before anything is executed, for reference:\r\n```\r\n5:10PM ERR paramsToEnv error=\"no secret found for \\\"\u003CTOKEN NAME>\\\"\"\r\n```\r\n\r\n### Validations\r\n\r\n- [X] Checked that the feature isn't part of the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\r\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\r\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\r\n- [X] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3173,3176],{"name":3174,"color":3175},"enhancement","7E1FE4",{"name":3177,"color":3178},"cli","1d76db",1970,"closed","Supplying secrets to woodpecker-cli exec command","2025-07-31T04:13:09Z","https://github.com/woodpecker-ci/woodpecker/issues/1970",0.7393207,{"description":3186,"labels":3187,"number":3192,"owner":3143,"repository":3144,"state":3180,"title":3193,"updated_at":3194,"url":3195,"score":3196},"### Clear and concise description of the problem\r\n\r\nI tried to use a global secret in some step, but was getting 401/Unauthorized every time.\r\n\r\n```yml\r\nmystep:\r\n image: foo\r\n commands:\r\n - foo bar --key \"$SOME_SECRET\"\r\n secrets:\r\n - some_secret\r\n```\r\n\r\nIt took me hours to find the real reason - when I added the secret I set the *\"Available for following images\"* field. So when I used it in a step with a different image, it was empty, i.e. `$SOME_SECRET = ''`.\r\n\r\nTo fix it, I added more images to that field.\r\n\r\n### Suggested solution\r\n\r\nPlease add an informative error for this situation. If the secret used in a step is not allowed for that image, print an error to the user.\r\n\r\nIf possible, don't even run the step because the secret will be empty and it will fail anyway.\r\n\r\n### Alternative\r\n\r\nNo\r\n\r\n### Additional context\r\n\r\n1.0.1\r\ndocker\r\n\r\n### Validations\r\n\r\n- [X] Checked that the feature isn't part of the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\r\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/main/CONTRIBUTING.md).\r\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\r\n- [X] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3188,3189],{"name":3140,"color":3141},{"name":3190,"color":3191},"ux","fef2c0",2233,"Print error when global secret disallowed for step's image","2023-11-05T18:55:44Z","https://github.com/woodpecker-ci/woodpecker/issues/2233",0.7396447,{"description":3198,"labels":3199,"number":3201,"owner":3143,"repository":3144,"state":3180,"title":3202,"updated_at":3203,"url":3204,"score":3205},"### Component\n\nweb-ui\n\n### Describe the bug\n\nHey guys,\n\nI tried to move global secrets to user secrets and I met something I was not expecting.\n\nFirst of all, I created secrets under my user: `user/secrets` from the UI. But these secrets were not available in my pipeline either shown in the tab \"secrets\" of the repository.\n\nFinally, I find organization secrets, that are not easy to find: `/orgs/2/settings/secrets`. Now, secrets are displayed inside the tab \"secrets\" of the repo with \"organization secret\" label.\n\nAccording the UI:\n> Organization secrets can be used in the pipelines of all repositories owned by the organization.\n\n> User secrets can be used in the pipelines of all repositories owned by the user.\n\nThe repository is mine, under my username in Gitea, so I was expected user secret to work. I can see in the UI that the organization is `tchoupinax` while my user is `Tchoupinax` (capitalized). Is it linked?\n\nQ: What's the usage of user secrets?\n\n**Summary**:\n- Organization secrets work\n- User secrets do not work\n\nThank for your work!\n\n### Steps to reproduce\n\nWoodpecker: 3.6.0\nGitea: 1.23.4\n\nCreate a repository under your user, start a pipeline.\n- Repo secrets work\n- Org secrets work\n- Global secrets work\n- **User secrets are not found**\n\n### Expected behavior\n\nI expect user secrets to be readable and showed under repo secrets tab\n\n### System Info\n\n```shell\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"3.6.0\"}\n```\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [x] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/versions]",[3200],{"name":3154,"color":3155},5218,"Difference between user secrets and organization secrets","2025-06-04T20:21:20Z","https://github.com/woodpecker-ci/woodpecker/issues/5218",0.7440838,{"description":3207,"labels":3208,"number":3209,"owner":3143,"repository":3144,"state":3180,"title":3210,"updated_at":3211,"url":3212,"score":3213},"### Clear and concise description of the problem\n\nA CLI subcommand to add a secret to all repos in an organization. Haven't yet found any discussion on this in here so I thought I start one :)\n\n### Suggested solution\n\nAn `orgsecret` subcommand similar to the one from `drone` CLI\n\n### Alternative\n\n_No response_\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[],1438,"CLI: `orgsecret` subcommand","2023-02-05T19:23:58Z","https://github.com/woodpecker-ci/woodpecker/issues/1438",0.7540403,{"description":3215,"labels":3216,"number":3224,"owner":3143,"repository":3144,"state":3180,"title":3225,"updated_at":3226,"url":3227,"score":3228},"### Component\n\nagent\n\n### Describe the bug\n\nCurrently the defined repository / organization secrets are injected on frontend compile phase as environment variables, used by the backend. In case of Kubernetes backend, these environment variables are logged on Kubernetes apiserver audit logs, often monitored by cluster administrators or SOC experts who should not learn these secrets unnecessarily. \n\n### Steps to reproduce\n\n1. Install woodpecker server & agent, with kubernetes backend\n2. Define a workflow with a repository secret containing a specific secret value, with a step using the secret\n3. Execute the workflow, ensure the step using the secret is executed\n4. Check cluster environment logs, e.g. apiserver audit logs for the specific secret value\n\n### Expected behavior\n\nSecret values should not be leaked to infrastructure logs; kubernetes secrets could be used to provide steps with specific secrets. \n\n### System Info\n\n```shell\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"dev\"}\n```\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [x] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/versions]",[3217,3218,3221],{"name":3154,"color":3155},{"name":3219,"color":3220},"security","B60205",{"name":3222,"color":3223},"backend/kubernetes","bfdadc",5195,"Kubernetes backend leaks secrets to Kubernetes apiserver audit logs","2025-06-14T20:44:34Z","https://github.com/woodpecker-ci/woodpecker/issues/5195",0.7551469,{"description":3230,"labels":3231,"number":3234,"owner":3143,"repository":3144,"state":3180,"title":3235,"updated_at":3236,"url":3237,"score":3238},"### Component\n\nserver\n\n### Describe the bug\n\nAfter creating a repository secret with name `TF_VAR_github_username` the name is altered in secrets list to `tf_var_github_username`. In workflow the secret is accessible as `TF_VAR_GITHUB_USERNAME`.\r\n\r\nIMHO the environment should stay `TF_VAR_github_username` ([terraform](https://github.com/hashicorp/terraform/issues/22671) is only an example here).\r\n\r\n \n\n### System Info\n\n```shell\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"2.2.2\"}\r\n\r\n\r\nDatabase: [CloudSQL](https://cloud.google.com/sql/docs/postgres/editions-intro) Postgres 14\r\nWoodpecker Server & Agent are running in k8s\n```\n\n\n### Additional context\n\nWorkaround:\r\n\r\n```yaml\r\ncommands:\r\n - export TF_VAR_github_token=$TF_VAR_GITHUB_TOKEN\r\n - export TF_VAR_github_username=$TF_VAR_GITHUB_USERNAME\r\n - terraform plan -lock=false\r\n```\r\n\r\ninstead of\r\n\r\n\r\n```yaml\r\ncommands: [terraform plan -lock=false]\r\n```\r\n\n\n### Validations\n\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]",[3232,3233],{"name":3154,"color":3155},{"name":3190,"color":3191},3290,"Case for secret names is altered","2024-02-20T13:20:27Z","https://github.com/woodpecker-ci/woodpecker/issues/3290",0.7558792,{"description":3240,"labels":3241,"number":3249,"owner":3143,"repository":3144,"state":3180,"title":3250,"updated_at":3251,"url":3252,"score":3253},"### Component\n\nweb-ui\n\n### Describe the bug\n\nyou can not have secrets for the close pull event atm\n\n### System Info\n\n```shell\nv2.1.1\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/main/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy) or the [Matrix room](https://matrix.to/#/#woodpecker:matrix.org).",[3242,3243,3246],{"name":3154,"color":3155},{"name":3244,"color":3245},"ui","46DEA2",{"name":3247,"color":3248},"good first issue","76ea72",3071,"pull request close envent not selectable on edit secret page","2023-12-31T20:43:26Z","https://github.com/woodpecker-ci/woodpecker/issues/3071",0.75723106,["Reactive",3255],{},["Set"],["ShallowReactive",3258],{"$fTRc1wZytZ_XrK4EfJfei_Sz-An4H4Yy6syhVxH_PVJc":-1,"$fiG8i5fz_tuWo73ZHYU7awm6KHMp3Fj-12ICPA8xSvnA":-1},"/woodpecker-ci/woodpecker/1341"]