\n\nThis is inconsistent with how secrets are handled elsewhere in Woodpecker:\n\nIn the Secrets section, users cannot view secret values (they can only update them).\n\nIn the Forge edit form, the OAuth Client Secret is already hidden by default.\n\n### Suggested solution\n\nIt would be preferable if the Git password field in the Forge UI were also hidden (like secrets), so that even Woodpecker admins cannot view these values in plaintext once they are saved.\n\n### Alternative\n\n_No response_\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Checked that the feature isn't part of the `next` version already [https://woodpecker-ci.org/versions]\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3167],{"name":3168,"color":3169},"feature","180DBE",5471,"Hide Bitbucket Data Center credentials in Forge UI","2025-08-31T10:17:07Z","https://github.com/woodpecker-ci/woodpecker/issues/5471",0.71755576,{"description":3176,"labels":3177,"number":3179,"owner":3143,"repository":3144,"state":3145,"title":3180,"updated_at":3181,"url":3182,"score":3183},"### Component\n\nserver\n\n### Describe the bug\n\nSlow authorization if user has many orgs/repos. Should probably do org/repo synchronization asynchronous \n\n### System Info\n\n```shell\nnext\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/main/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy) or the [Matrix room](https://matrix.to/#/#woodpecker:matrix.org).",[3178],{"name":3154,"color":3155},2502,"Slow authorization if user has many orgs/repos","2024-12-08T12:10:56Z","https://github.com/woodpecker-ci/woodpecker/issues/2502",0.7322202,{"description":3185,"labels":3186,"number":3188,"owner":3143,"repository":3144,"state":3189,"title":3190,"updated_at":3191,"url":3192,"score":3193},"### Component\n\nweb-ui\n\n### Describe the bug\n\nHey guys,\n\nI tried to move global secrets to user secrets and I met something I was not expecting.\n\nFirst of all, I created secrets under my user: `user/secrets` from the UI. But these secrets were not available in my pipeline either shown in the tab \"secrets\" of the repository.\n\nFinally, I find organization secrets, that are not easy to find: `/orgs/2/settings/secrets`. Now, secrets are displayed inside the tab \"secrets\" of the repo with \"organization secret\" label.\n\nAccording the UI:\n> Organization secrets can be used in the pipelines of all repositories owned by the organization.\n\n> User secrets can be used in the pipelines of all repositories owned by the user.\n\nThe repository is mine, under my username in Gitea, so I was expected user secret to work. I can see in the UI that the organization is `tchoupinax` while my user is `Tchoupinax` (capitalized). Is it linked?\n\nQ: What's the usage of user secrets?\n\n**Summary**:\n- Organization secrets work\n- User secrets do not work\n\nThank for your work!\n\n### Steps to reproduce\n\nWoodpecker: 3.6.0\nGitea: 1.23.4\n\nCreate a repository under your user, start a pipeline.\n- Repo secrets work\n- Org secrets work\n- Global secrets work\n- **User secrets are not found**\n\n### Expected behavior\n\nI expect user secrets to be readable and showed under repo secrets tab\n\n### System Info\n\n```shell\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"3.6.0\"}\n```\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [x] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/versions]",[3187],{"name":3154,"color":3155},5218,"closed","Difference between user secrets and organization secrets","2025-06-04T20:21:20Z","https://github.com/woodpecker-ci/woodpecker/issues/5218",0.6335509,{"description":3195,"labels":3196,"number":3201,"owner":3143,"repository":3144,"state":3189,"title":3202,"updated_at":3203,"url":3204,"score":3205},"### Component\n\nagent\n\n### Describe the bug\n\nThis is a very intermittent bug that has been hard to track down. We run Woodpecker on GitHub in an [organization protected by organization SAML enforcement](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-saml-single-sign-on-for-your-organization/enforcing-saml-single-sign-on-for-your-organization#about-enforcement-of-saml-sso-for-your-organization).\r\n\r\nThis has happened twice, once in December 2023, then on the 29th of April. When it does, most of our builds will start to fail with the following error:\r\n\r\n```\r\n{\"level\":\"error\",\"error\":\"GET https://api.github.com/repos/quintoandar/\u003Credacted>/contents/.woodpecker?ref=ced8fe72e731630f9888d10f4aad083071f0b83d: 403 Resource protected by organization SAML enforcement. You must grant your OAuth token access to this organization. []\",\"repo\":\"quintoandar/\u003Credacted>\",\"user\":\"\u003Credacted>\",\"time\":\"2024-04-29T18:17:15Z\",\"message\":\"could not get folder from forge\"}\r\n```\r\n\r\nThis essentially means that the user that activated the repository (the user Woodpecker is making requests on behalf on to clone the repository and retrieve the woodpecker file) is authenticated but their token has not been granted access to the organization.\r\n\r\nWe've found out that when this happens, the \"fix\" was _apparently_ to logout and then login again with the indicated user. After that the builds would work again, presumably because Woodpecker would have generated a new, valid token.\r\n\r\nTo avoid dealing with issues of users leaving the organization we tend to automate enabling of Woodpecker repositories so they all authenticate on behalf of the same user. Initially we were using a \"bot\" GitHub account dedicated for this. However, after this bug, we've moved to using an administrador's account, since it's easier to logout/login of said account to fix the problem. Either way the point being that most repositories will be making their requests on behalf of the same user, which avoids situations of \"random user has left the organization, breaking random repository number 42\" _but_ at the same time makes this issue way more destructive, as when it happens our whole Woodpecker instances stops working.\r\n\r\nThis seems very similar to this issue https://github.com/woodpecker-ci/woodpecker/discussions/2482 except that:\r\n\r\n1. We have already configured Woodpecker as an Oauth App, which should not have expiring tokens.\r\n\r\n2. The issue blocking access is always specifically about SAML enforcement; the token _seems_ to be valid as in authenticated, just not authorized to access the organization.\r\n\r\nAs a further data point, at \"random\" interval (as in every several weeks) both Drone (which we have used in the past and still keep a legacy instance around) and Woodpecker will pop-up a window like the one below, asking me and other developers to authorize the organization. I am not sure if this is related or not to the problem.\r\n\r\n\r\n\r\n I assume that it's possible if, for example, the user/administrator on who's behalf the requests are being made would deny access to Woodpecker/Drone on the pop-up above, then the requests would fail... however:\r\n\r\n- This has never happened with Drone (and still doesn't happen with our legacy Drone instance so there's some chance it was introduced on Woodpecker)\r\n\r\n- The first time the issue happened, said \"bot\" user we were using to making requests on behalf had not been accessed (as it is seldom accessed by humans)\n\n### Steps to reproduce\n\nUnfortunately we do not know how to reproduce this behavior.\n\n### Expected behavior\n\n_No response_\n\n### System Info\n\n```shell\nWoodpecker 2.3.0\r\nKubernetes Backend\r\nGitHub forge\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]",[3197,3198],{"name":3154,"color":3155},{"name":3199,"color":3200},"forge/github","E96280",3804,"Unauthorized user tokens preventing builds from running when protected by SAML enforcement","2024-11-22T18:12:45Z","https://github.com/woodpecker-ci/woodpecker/issues/3804",0.6984889,{"description":3207,"labels":3208,"number":3213,"owner":3143,"repository":3144,"state":3189,"title":3214,"updated_at":3215,"url":3216,"score":3217},"### Component\n\nweb-ui\n\n### Describe the bug\n\nCreating a new secret using the web-ui results in the following error: `: user not authorized`\r\n\r\nCan anyone confirm this?\n\n### Steps to reproduce\n\n1. Log in the web-ui\r\n2. Go to `settings` -> `secrets` -> `add secret`\r\n3. add a secret, e.g. name `mail` and some random value like `abc`\r\n4. click `add secret`\r\n5. see error message `: user not authorized`. Also, the secret is not added.\n\n### Expected behavior\n\nno error message, adding a secret works\n\n### System Info\n\n```shell\n`{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"2.8.0\"}`\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]",[3209,3210],{"name":3154,"color":3155},{"name":3211,"color":3212},"feedback","4B7070",4545,"Can not create secret","2024-12-22T08:53:05Z","https://github.com/woodpecker-ci/woodpecker/issues/4545",0.70151997,{"description":3219,"labels":3220,"number":3226,"owner":3143,"repository":3144,"state":3189,"title":3227,"updated_at":3228,"url":3229,"score":3230},"### Component\n\nagent\n\n### Describe the bug\n\nCurrently the defined repository / organization secrets are injected on frontend compile phase as environment variables, used by the backend. In case of Kubernetes backend, these environment variables are logged on Kubernetes apiserver audit logs, often monitored by cluster administrators or SOC experts who should not learn these secrets unnecessarily. \n\n### Steps to reproduce\n\n1. Install woodpecker server & agent, with kubernetes backend\n2. Define a workflow with a repository secret containing a specific secret value, with a step using the secret\n3. Execute the workflow, ensure the step using the secret is executed\n4. Check cluster environment logs, e.g. apiserver audit logs for the specific secret value\n\n### Expected behavior\n\nSecret values should not be leaked to infrastructure logs; kubernetes secrets could be used to provide steps with specific secrets. \n\n### System Info\n\n```shell\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"dev\"}\n```\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [x] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/versions]",[3221,3222,3223],{"name":3154,"color":3155},{"name":3157,"color":3158},{"name":3224,"color":3225},"backend/kubernetes","bfdadc",5195,"Kubernetes backend leaks secrets to Kubernetes apiserver audit logs","2025-06-14T20:44:34Z","https://github.com/woodpecker-ci/woodpecker/issues/5195",0.70505977,{"description":3232,"labels":3233,"number":3237,"owner":3143,"repository":3144,"state":3189,"title":3238,"updated_at":3239,"url":3240,"score":3241},"### Component\n\nweb-ui\n\n### Describe the bug\n\nAdding new secrets using the UI interface is not saving the value.\n\n\n### Steps to reproduce\n\nGo to Repository -> Settings -> Secrets\n\n1. Add a new key in Name field. i.e: SECRET_ONE\n2. add the value: 12345ABC\n3. Check events: CRON and MANUAL\n4.1 Click on Save Secret\n4.2. if you check again the saved secrets the value field will be empty, not sure if this is expected to avoid showing the secrets or the real bug.\n\n5. Edit .woodpecker.yml for your project adding:\n\nsteps:\n test:\n image: python:3.12\n commands:\n - 'echo \"The secret is: $SECRET_ONE\"'\n\n6. trigger your pipeline manually \n7. Check logs. \n\nExpected: \nThe secret is: 12345ABC\n\nActual result:\nThe secret is: \n\n### Expected behavior\n\nSecrets should be accessed by the commands in woodpecker.yml file\n\n### System Info\n\n```shell\nEnvironment:\nWoodpecker 3.6.0 running in docker locally\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"3.6.0\"}\n```\n\n### Additional context\n\n\n\n### Validations\n\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [x] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/versions]",[3234],{"name":3235,"color":3236},"question","d876e3",5173,"Secrets not saved using Settings - > secrets","2025-05-14T07:39:46Z","https://github.com/woodpecker-ci/woodpecker/issues/5173",0.7085668,{"description":3243,"labels":3244,"number":3246,"owner":3143,"repository":3144,"state":3189,"title":3247,"updated_at":3248,"url":3249,"score":3250},"### Component\n\nserver\n\n### Describe the bug\n\nI am using the Docker container for Woodpecker connected to Forgejo. The Forgejo server uses an external OIDC IDP for authentication. When I add a repo, sometimes I will get the message \"An unknown error has occured\". In the Docker logs, I see the attached log messages and traceback. Interestingly. it seems that I can add projects that are under my user namespace; but not ones that are under an organization (despite me owning the org in Forgejo).\n\n### Steps to reproduce\n\n1. Start container with compose config:\n\n```\n ci-srv:\n image: woodpeckerci/woodpecker-server:latest\n volumes:\n - ./data/ci-srv-data:/var/lib/woodpecker/\n environment:\n - WOODPECKER_OPEN=true\n - WOODPECKER_HOST=[redacted]\n - WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}\n - WOODPECKER_FORGEJO=true\n - WOODPECKER_FORGEJO_URL=[redacted]\n - WOODPECKER_FORGEJO_CLIENT=${WOODPECKER_FORGEJO_CLIENT}\n - WOODPECKER_FORGEJO_SECRET=${WOODPECKER_FORGEJO_SECRET}\n networks:\n - http_proxy\n - git\n labels:\n - \"traefik.enable=true\"\n - \"traefik.docker.network=traefik_http_proxy\"\n - \"traefik.http.routers.ci.rule=Host(`[redacted]`)\"\n - \"traefik.http.routers.ci.entrypoints=websecure\"\n - \"traefik.http.routers.ci.tls=true\"\n - \"traefik.http.routers.ci.tls.certresolver=letsencrypt\"\n - \"traefik.http.services.ci.loadbalancer.server.port=8000\"\n\n```\n\n2. Browse to Forgejo\n3. Log in via Forgejo (and thus via my IDP)\n4. Click Add Repository\n5. Click Enable on any repository that is not under my user namespace.\n\n### Expected behavior\n\nWhen I click \"Enable\" on a repository I expect it to enable with success.\n\n### System Info\n\n```shell\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"2.8.3\"}\n```\n\n### Additional context\n\n```\n2025/01/26 22:54:56 [Recovery] 2025/01/26 - 22:54:56 panic recovered:\nruntime error: invalid memory address or nil pointer dereference\n/usr/local/go/src/runtime/panic.go:261 (0x458ff7)\n/usr/local/go/src/runtime/signal_unix.go:881 (0x458fc5)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/server/api/repo.go:149 (0xddd5dd)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xaeeb4a)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/session/user.go:118 (0xe44f86)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xe3d3e2)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/token/token.go:40 (0xe3d3d0)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xaeeb4a)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/session/user.go:73 (0xe4796e)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xaeeb4a)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/store.go:28 (0x1093dee)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xaeeb4a)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:37 (0x1093ea5)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xe3d1b7)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/header/header.go:38 (0xe3d0e4)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xe3d038)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/header/header.go:30 (0xe3d026)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xe441e7)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/router.go:44 (0xe441d5)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xafbfd9)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/recovery.go:102 (0xafbfc7)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/context.go:185 (0xafad71)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/gin.go:633 (0xafa7e0)\n/woodpecker/src/github.com/woodpecker-ci/woodpecker/vendor/github.com/gin-gonic/gin/gin.go:589 (0xafa311)\n/usr/local/go/src/net/http/server.go:3142 (0x89d6ad)\n/usr/local/go/src/net/http/server.go:2044 (0x898987)\n/usr/local/go/src/runtime/asm_amd64.s:1695 (0x47b540)\n```\n\n### Validations\n\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [x] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]",[3245],{"name":3154,"color":3155},4782,"Adding Repository Fails","2025-01-31T06:22:09Z","https://github.com/woodpecker-ci/woodpecker/issues/4782",0.71694124,["Reactive",3252],{},["Set"],["ShallowReactive",3255],{"$fTRc1wZytZ_XrK4EfJfei_Sz-An4H4Yy6syhVxH_PVJc":-1,"$fM-AHuHxF1NHq7_aQxoxuGo5iA8PtsAdOr-aOrEpCwhg":-1},"/woodpecker-ci/woodpecker/4543"]