ci_trust.go RawHistoryFolder

1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package domain
4
5// TrustedActor reports whether a run started by p is trusted: its jobs get
6// secrets and, later, the write permissions of their workflow (CI-3, D1).
7//
8// Only the owner is trusted: the root token, the owner signed in on the web, and
9// a stored token with the owner's rights (every scope, no repository list, no
10// branch prefixes: Principal.HasOwnerRights). Everything else is not: a token
11// limited to branch prefixes (an automated agent could otherwise push a
12// workflow that prints any secret), a token limited to some repositories or
13// scopes, a job token and an anonymous caller. When in doubt the answer is no:
14// an untrusted run only misses its secrets, a trusted one by mistake leaks them.
15func TrustedActor(p Principal) bool { return p.HasOwnerRights() }
16
17// RerunTrusted is the trusted flag of a new attempt of a run: the run was
18// trusted and the caller of the re-run is trusted too. A re-run keeps the flag
19// or lowers it and never raises it: the owner who runs an agent's run again
20// does not unlock its secrets.
21func RerunTrusted(original bool, caller Principal) bool { return original && TrustedActor(caller) }