Support Git as only VCS (#4346)

Co-authored-by: Patrick Schratz <patrick.schratz@gmail.com>

cli/exec/flags.go

@@ -157,12 +157,6 @@ var flags = []cli.Flag{
 		Name:    "repo-url",
 		Usage:   "Set the metadata environment variable \"CI_REPO_URL\".",
 	},
-	&cli.StringFlag{
-		Sources: cli.EnvVars("CI_REPO_SCM"),
-		Name:    "repo-scm",
-		Usage:   "Set the metadata environment variable \"CI_REPO_SCM\".",
-		Value:   "git",
-	},
 	&cli.StringFlag{
 		Sources: cli.EnvVars("CI_REPO_DEFAULT_BRANCH"),
 		Name:    "repo-default-branch",

cli/exec/metadata.go

@@ -78,7 +78,6 @@ func metadataFromContext(_ context.Context, c *cli.Command, axis matrix.Axis, w
 	// Repo
 	metadataFileAndOverrideOrDefault(c, "repo-remote-id", func(s string) { m.Repo.RemoteID = s }, c.String)
 	metadataFileAndOverrideOrDefault(c, "repo-url", func(s string) { m.Repo.ForgeURL = s }, c.String)
-	metadataFileAndOverrideOrDefault(c, "repo-scm", func(s string) { m.Repo.SCM = s }, c.String)
 	metadataFileAndOverrideOrDefault(c, "repo-default-branch", func(s string) { m.Repo.Branch = s }, c.String)
 	metadataFileAndOverrideOrDefault(c, "repo-clone-url", func(s string) { m.Repo.CloneURL = s }, c.String)
 	metadataFileAndOverrideOrDefault(c, "repo-clone-ssh-url", func(s string) { m.Repo.CloneSSHURL = s }, c.String)

cmd/server/openapi/docs.go

@@ -5115,9 +5115,6 @@ const docTemplate = `{
                 "require_approval": {
                     "$ref": "#/definitions/model.ApprovalMode"
                 },
-                "scm": {
-                    "$ref": "#/definitions/SCMKind"
-                },
                 "timeout": {
                     "type": "integer"
                 },
@@ -5184,21 +5181,6 @@ const docTemplate = `{
                 "VisibilityInternal"
             ]
         },
-        "SCMKind": {
-            "type": "string",
-            "enum": [
-                "git",
-                "hg",
-                "fossil",
-                "perforce"
-            ],
-            "x-enum-varnames": [
-                "RepoGit",
-                "RepoHg",
-                "RepoFossil",
-                "RepoPerforce"
-            ]
-        },
         "Secret": {
             "type": "object",
             "properties": {
@@ -5581,9 +5563,6 @@ const docTemplate = `{
                 "remote_id": {
                     "type": "string"
                 },
-                "scm": {
-                    "type": "string"
-                },
                 "trusted": {
                     "$ref": "#/definitions/metadata.TrustedConfiguration"
                 }

docs/docs/20-usage/20-workflow-syntax.md

@@ -686,16 +686,6 @@ Example configuration to use a custom clone plugin:
 +    image: octocat/custom-git-plugin
 ```
 
-Example configuration to clone Mercurial repository:
-
-```diff
- clone:
-   - name: hg
-+    image: plugins/hg
-+    settings:
-+      path: bitbucket.org/foo/bar
-```
-
 ### Git Submodules
 
 To use the credentials that cloned the repository to clone it's submodules, update `.gitmodules` to use `https` instead of `git`:

docs/docs/20-usage/50-environment.md

@@ -56,7 +56,6 @@ This is the reference list of all environment variables available to your pipeli
 | `CI_REPO_OWNER`                  | repository owner                                                                                                   | `john-doe`                                                                                 |
 | `CI_REPO_NAME`                   | repository name                                                                                                    | `my-repo`                                                                                  |
 | `CI_REPO_REMOTE_ID`              | repository remote ID, is the UID it has in the forge                                                               | `82`                                                                                       |
-| `CI_REPO_SCM`                    | repository SCM                                                                                                     | `git`                                                                                      |
 | `CI_REPO_URL`                    | repository web URL                                                                                                 | `https://git.example.com/john-doe/my-repo`                                                 |
 | `CI_REPO_CLONE_URL`              | repository clone URL                                                                                               | `https://git.example.com/john-doe/my-repo.git`                                             |
 | `CI_REPO_CLONE_SSH_URL`          | repository SSH clone URL                                                                                           | `git@git.example.com:john-doe/my-repo.git`                                                 |

docs/src/pages/migrations.md

@@ -140,6 +140,10 @@ The following restructuring was done to achieve a more consistent grouping:
 - The `latest` tag has been dropped to avoid accidental major version upgrades.
   A dedicated semver tag specification must be used, i.e., either a fixed version (like `v3.0.0`) or a rolling tag (e.g. `v3.0` or `v3`).
 
+- Git is now the only officially supported SCM.
+  No others were supported previously, but the existence of the env var `CI_REPO_SCM` indicated that others might be.
+  The env var has now been removed including unused code associated with it.
+
 - Previously, some (official) plugins were granted the `privileged` option by default to allow simplified usage.
   To streamline this process and enhance security transparency, no plugin is granted the `privileged` options by default anymore.
   To allow the use of these plugins in >= 3.0, they must be set explicitly through `WOODPECKER_PLUGINS_PRIVILEGED` on the admin side.
@@ -168,6 +172,60 @@ The following restructuring was done to achieve a more consistent grouping:
 
 - Webhook signatures now use the `rfc9421` protocol
 
+## User migrations
+
+- `gated` has been replaced by `require-approval`
+- Removed built-in environment variables:
+  - `CI_COMMIT_URL` use `CI_PIPELINE_FORGE_URL`
+  - `CI_STEP_FINISHED` as empty during execution
+  - `CI_PIPELINE_FINISHED` as empty during execution
+  - `CI_PIPELINE_STATUS` was always `success`
+  - `CI_STEP_STATUS` was always `success`
+  - `CI_REPO_SCM` was always `git`
+- Set `/woodpecker` as default workdir for the **woodpecker-cli** container
+- Secret filters for plugins now check against tag if specified
+- Compatibility mode of deprecated `pipeline:`, `platform:` and `branches:` pipeline config options are now removed and pipeline will now fail if still in use.
+- Removed `steps.[name].group` in favor of `steps.[name].depends_on` (see [workflow syntax](/docs/usage/workflow-syntax#depends_on) to learn how to set dependencies)
+- Pipelines without a config file will now be skipped instead of failing
+- Removed `includes` and `excludes` support from **event** filter
+- Removed upper-casing all secret env vars, instead, the value of the `secrets` property is used. [Read more](/docs/usage/secrets#usage)
+- Removed alternative names for secrets, use `environment` with `from_secret`
+- Removed `environment` filter, use `when.evaluate`
+- Removed `WOODPECKER_WEBHOOK_HOST` in favor of `WOODPECKER_EXPERT_WEBHOOK_HOST`
+- Renamed `start_time`, `end_time`, `created_at`, `started_at`, `finished_at` and `reviewed_at` JSON fields to `started`, `finished`, `created`, `started`, `finished`, `reviewed`
+- JSON field `trusted` on repo model was changed from boolean to object
+- Update all webhooks by pressing the "Repair all" button in the admin settings as the webhook token claims have changed
+- Crons now use standard Linux syntax without seconds
+- Removed old API routes: `registry/` -> `registries`, `/authorize/token`
+- Replaced `registry` command with `repo registry` in cli
+- Deprecated `secrets`, use `environment` with `from_secret`
+- Empty string environment variables are not set
+- CLI commands got restructured to provide a simplified structure:
+  - `woodpecker-cli secret [add|rm|...] --global` is now `woodpecker-cli admin secret [add|rm|...]`
+  - `woodpecker-cli user` is now `woodpecker-cli admin user`
+  - `woodpecker-cli log-level` is now `woodpecker-cli admin log-level`
+  - `woodpecker-cli secret [add|rm|...] --organization` is now `woodpecker-cli org secret [add|rm|...]`
+  - `woodpecker-cli deploy` is now `woodpecker-cli pipeline deploy`
+  - `woodpecker-cli log` is now `woodpecker-cli pipeline log`
+  - `woodpecker-cli cron` is now `woodpecker-cli repo cron`
+  - `woodpecker-cli secret [add|rm|...] --repository` is now `woodpecker-cli repo secret [add|rm|...]`
+  - `woodpecker-cli pipeline logs` is now `woodpecker-cli pipeline log show`
+  - `woodpecker-cli [registry|secret|...] info` is now `woodpecker-cli [registry|secret|...] show`
+
+## Admin migrations
+
+- Deprecate `WOODPECKER_LOG_XORM` and `WOODPECKER_LOG_XORM_SQL` use `"WOODPECKER_DATABASE_LOG` and `"WOODPECKER_DATABASE_LOG_SQL`
+- Deprecate `WOODPECKER_FILTER_LABELS` use `WOODPECKER_AGENT_LABELS`
+- Move docker resource limit settings from server into agent configuration
+- Rename server environment variable `WOODPECKER_ESCALATE` to `WOODPECKER_PLUGINS_PRIVILEGED`
+- All default privileged plugins (like `woodpeckerci/plugin-docker-buildx`) were removed. Please carefully [re-add those plugins](/docs/next/administration/server-config#woodpecker_plugins_privileged) you trust and rely on.
+- `WOODPECKER_DEFAULT_CLONE_IMAGE` got deprecated use `WOODPECKER_DEFAULT_CLONE_PLUGIN`
+- Check trusted-clone- and privileged-plugins by image name and tag (if tag is set)
+- Removed `WOODPECKER_DEV_OAUTH_HOST` and `WOODPECKER_DEV_GITEA_OAUTH_URL` use `WOODPECKER_EXPERT_FORGE_OAUTH_HOST`
+- Removed `WOODPECKER_ROOT_PATH` and `WOODPECKER_ROOT_URL` config variables. Use `WOODPECKER_HOST` with a path instead
+- Removed implicitly defined `regcred` image pull secret name. Set it explicitly via `WOODPECKER_BACKEND_K8S_PULL_SECRET_NAMES`
+- Removed slice definition for env vars
+- Migrated to rfc9421 for webhook signatures
 - Replaced `configs` object by `netrc` in external configuration APIs
 
 - Upgrading from 1.x versions to 3.x is disallowed, upgrading to 2.x first is required to ensure proper DB migrations

pipeline/backend/local/clone.go

@@ -63,10 +63,6 @@ func (e *local) setupClone(state *workflowState) error {
 
 // execClone executes a clone-step locally.
 func (e *local) execClone(ctx context.Context, step *types.Step, state *workflowState, env []string) error {
-	if scm := step.Environment["CI_REPO_SCM"]; scm != "git" {
-		return fmt.Errorf("local backend can only clone from git repos, but this repo use '%s'", scm)
-	}
-
 	if err := checkGitCloneCap(); err != nil {
 		return fmt.Errorf("check for git clone capabilities failed: %w", err)
 	}

pipeline/frontend/metadata/drone_compatibility.go

@@ -45,7 +45,6 @@ func SetDroneEnviron(env map[string]string) {
 	copyEnv("CI_COMMIT_AUTHOR_AVATAR", "DRONE_COMMIT_AUTHOR_AVATAR", env)
 	// repo
 	copyEnv("CI_REPO", "DRONE_REPO", env)
-	copyEnv("CI_REPO_SCM", "DRONE_REPO_SCM", env)
 	copyEnv("CI_REPO_OWNER", "DRONE_REPO_OWNER", env)
 	copyEnv("CI_REPO_NAME", "DRONE_REPO_NAME", env)
 	copyEnv("CI_REPO_URL", "DRONE_REPO_LINK", env)
@@ -59,6 +58,7 @@ func SetDroneEnviron(env map[string]string) {
 	copyEnv("CI_STEP_NUMBER", "DRONE_STEP_NUMBER", env)
 
 	env["DRONE_BUILD_STATUS"] = "success"
+	env["DRONE_REPO_SCM"] = "git"
 
 	// some quirks
 

pipeline/frontend/metadata/drone_compatibility_test.go

@@ -59,7 +59,6 @@ CI_REPO_CLONE_URL=https://codeberg.org/Epsilon_02/todo-checker.git
 CI_REPO_DEFAULT_BRANCH=main
 CI_REPO_NAME=todo-checker
 CI_REPO_OWNER=Epsilon_02
-CI_REPO_SCM=git
 CI_STEP_NAME=wp_01h1z7v5d1tskaqjexw0ng6w7d_0_step_3
 CI_STEP_STARTED=1685749339
 CI_SYSTEM_PLATFORM=linux/amd64
@@ -164,7 +163,6 @@ CI_REPO_NAME=woodpecker-test
 CI_REPO_OWNER=test
 CI_REPO_PRIVATE=false
 CI_REPO_REMOTE_ID=4
-CI_REPO_SCM=git
 CI_REPO_TRUSTED=false
 CI_REPO_TRUSTED_NETWORK=false
 CI_REPO_TRUSTED_VOLUMES=false

pipeline/frontend/metadata/environment.go

@@ -53,7 +53,6 @@ func (m *Metadata) Environ() map[string]string {
 	setNonEmptyEnvVar(params, "CI_REPO_NAME", repo.Name)
 	setNonEmptyEnvVar(params, "CI_REPO_OWNER", repo.Owner)
 	setNonEmptyEnvVar(params, "CI_REPO_REMOTE_ID", repo.RemoteID)
-	setNonEmptyEnvVar(params, "CI_REPO_SCM", repo.SCM)
 	setNonEmptyEnvVar(params, "CI_REPO_URL", repo.ForgeURL)
 	setNonEmptyEnvVar(params, "CI_REPO_CLONE_URL", repo.CloneURL)
 	setNonEmptyEnvVar(params, "CI_REPO_CLONE_SSH_URL", repo.CloneSSHURL)

pipeline/frontend/metadata/types.go

@@ -34,7 +34,6 @@ type (
 		Owner       string               `json:"owner,omitempty"`
 		RemoteID    string               `json:"remote_id,omitempty"`
 		ForgeURL    string               `json:"forge_url,omitempty"`
-		SCM         string               `json:"scm,omitempty"`
 		CloneURL    string               `json:"clone_url,omitempty"`
 		CloneSSHURL string               `json:"clone_url_ssh,omitempty"`
 		Private     bool                 `json:"private,omitempty"`

server/forge/bitbucket/convert.go

@@ -59,14 +59,10 @@ func convertRepo(from *internal.Repo, perm *internal.RepoPerm) *model.Repo {
 		ForgeURL:      from.Links.HTML.Href,
 		IsSCMPrivate:  from.IsPrivate,
 		Avatar:        from.Owner.Links.Avatar.Href,
-		SCMKind:       model.SCMKind(from.Scm),
 		Branch:        from.MainBranch.Name,
 		Perm:          convertPerm(perm),
 		PREnabled:     true,
 	}
-	if repo.SCMKind == model.RepoHg {
-		repo.Branch = "default"
-	}
 	return &repo
 }
 

server/forge/bitbucket/convert_test.go

@@ -48,7 +48,7 @@ func Test_helper(t *testing.T) {
 			from := &internal.Repo{
 				FullName:  "octocat/hello-world",
 				IsPrivate: true,
-				Scm:       "hg",
+				Scm:       "git",
 			}
 			from.Owner.Links.Avatar.Href = "http://..."
 			from.Links.HTML.Href = "https://bitbucket.org/foo/bar"
@@ -61,8 +61,6 @@ func Test_helper(t *testing.T) {
 			g.Assert(to.FullName).Equal(from.FullName)
 			g.Assert(to.Owner).Equal("octocat")
 			g.Assert(to.Name).Equal("hello-world")
-			g.Assert(to.Branch).Equal("default")
-			g.Assert(string(to.SCMKind)).Equal(from.Scm)
 			g.Assert(to.IsSCMPrivate).Equal(from.IsPrivate)
 			g.Assert(to.Clone).Equal(from.Links.HTML.Href)
 			g.Assert(to.ForgeURL).Equal(from.Links.HTML.Href)

server/forge/bitbucket/parse_test.go

@@ -125,7 +125,6 @@ func Test_parser(t *testing.T) {
 				r, b, err := parseHook(req)
 				g.Assert(err).IsNil()
 				g.Assert(r.FullName).Equal("martinherren1984/publictestrepo")
-				g.Assert(r.SCMKind).Equal(model.RepoGit)
 				g.Assert(r.Clone).Equal("https://bitbucket.org/martinherren1984/publictestrepo")
 				g.Assert(b.Commit).Equal("c14c1bb05dfb1fdcdf06b31485fff61b0ea44277")
 				g.Assert(b.Message).Equal("a\n")

server/forge/bitbucketdatacenter/convert.go

@@ -56,7 +56,6 @@ func convertRepo(from *bb.Repository, perm *model.Perm, branch string) *model.Re
 		Name:          from.Slug,
 		Owner:         from.Project.Key,
 		Branch:        branch,
-		SCMKind:       model.RepoGit,
 		IsSCMPrivate:  true, // Since we have to use Netrc it has to always be private :/ TODO: Is this really true?
 		FullName:      fmt.Sprintf("%s/%s", from.Project.Key, from.Slug),
 		Perm:          perm,

server/forge/bitbucketdatacenter/convert_test.go

@@ -83,7 +83,6 @@ func TestHelper(t *testing.T) {
 			g.Assert(to.Name).Equal("REPO")
 			g.Assert(to.Owner).Equal("PRJ")
 			g.Assert(to.Branch).Equal("main")
-			g.Assert(to.SCMKind).Equal(model.RepoGit)
 			g.Assert(to.FullName).Equal("PRJ/REPO")
 			g.Assert(to.Perm).Equal(perm)
 			g.Assert(to.Clone).Equal("https://git.domain/clone")

server/forge/forgejo/helper.go

@@ -37,7 +37,6 @@ func toRepo(from *forgejo.Repository) *model.Repo {
 	)
 	return &model.Repo{
 		ForgeRemoteID: model.ForgeRemoteID(fmt.Sprint(from.ID)),
-		SCMKind:       model.RepoGit,
 		Name:          name,
 		Owner:         from.Owner.UserName,
 		FullName:      from.FullName,

server/forge/forgejo/parse_test.go

@@ -55,7 +55,6 @@ func TestForgejoParser(t *testing.T) {
 				Clone:         "https://codeberg.org/meisam/woodpecktester.git",
 				CloneSSH:      "git@codeberg.org:meisam/woodpecktester.git",
 				Branch:        "main",
-				SCMKind:       "git",
 				PREnabled:     true,
 				Perm: &model.Perm{
 					Pull:  true,
@@ -90,7 +89,6 @@ func TestForgejoParser(t *testing.T) {
 				ForgeURL:      "http://forgejo.golang.org/gordon/hello-world",
 				Clone:         "http://forgejo.golang.org/gordon/hello-world.git",
 				CloneSSH:      "git@forgejo.golang.org:gordon/hello-world.git",
-				SCMKind:       "git",
 				IsSCMPrivate:  true,
 				Perm: &model.Perm{
 					Pull:  true,
@@ -126,7 +124,6 @@ func TestForgejoParser(t *testing.T) {
 				Clone:         "http://127.0.0.1:3000/Test-CI/multi-line-secrets.git",
 				CloneSSH:      "ssh://git@127.0.0.1:2200/Test-CI/multi-line-secrets.git",
 				Branch:        "main",
-				SCMKind:       "git",
 				Perm: &model.Perm{
 					Pull:  true,
 					Push:  true,
@@ -161,7 +158,6 @@ func TestForgejoParser(t *testing.T) {
 				Clone:         "http://forgejo.golang.org/gordon/hello-world.git",
 				CloneSSH:      "git@forgejo.golang.org:gordon/hello-world.git",
 				Branch:        "main",
-				SCMKind:       "git",
 				IsSCMPrivate:  true,
 				Perm: &model.Perm{
 					Pull:  true,
@@ -195,7 +191,6 @@ func TestForgejoParser(t *testing.T) {
 				Clone:         "https://forgejo.golang.org/gordon/hello-world.git",
 				CloneSSH:      "",
 				Branch:        "main",
-				SCMKind:       "git",
 				IsSCMPrivate:  true,
 				Perm: &model.Perm{
 					Pull:  true,
@@ -233,7 +228,6 @@ func TestForgejoParser(t *testing.T) {
 				Clone:         "http://127.0.0.1:3000/Test-CI/multi-line-secrets.git",
 				CloneSSH:      "ssh://git@127.0.0.1:2200/Test-CI/multi-line-secrets.git",
 				Branch:        "main",
-				SCMKind:       "git",
 				PREnabled:     true,
 				IsSCMPrivate:  false,
 				Perm: &model.Perm{
@@ -275,7 +269,6 @@ func TestForgejoParser(t *testing.T) {
 				Clone:         "https://forgejo.com/anbraten/test-repo.git",
 				CloneSSH:      "git@forgejo.com:anbraten/test-repo.git",
 				Branch:        "main",
-				SCMKind:       "git",
 				PREnabled:     true,
 				Perm: &model.Perm{
 					Pull:  true,
@@ -313,7 +306,6 @@ func TestForgejoParser(t *testing.T) {
 				Clone:         "https://forgejo.com/anbraten/test-repo.git",
 				CloneSSH:      "git@forgejo.com:anbraten/test-repo.git",
 				Branch:        "main",
-				SCMKind:       "git",
 				PREnabled:     true,
 				Perm: &model.Perm{
 					Pull:  true,
@@ -351,7 +343,6 @@ func TestForgejoParser(t *testing.T) {
 				Clone:         "https://git.xxx/anbraten/demo.git",
 				CloneSSH:      "ssh://git@git.xxx:22/anbraten/demo.git",
 				Branch:        "main",
-				SCMKind:       "git",
 				PREnabled:     true,
 				IsSCMPrivate:  true,
 				Perm: &model.Perm{

server/forge/gitea/helper.go

@@ -38,7 +38,6 @@ func toRepo(from *gitea.Repository) *model.Repo {
 	)
 	return &model.Repo{
 		ForgeRemoteID: model.ForgeRemoteID(fmt.Sprint(from.ID)),
-		SCMKind:       model.RepoGit,
 		Name:          name,
 		Owner:         from.Owner.UserName,
 		FullName:      from.FullName,