mirrors/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-10-14 13:12:29 +00:00
Code Issues Projects Releases Packages Wiki Activity

feat: migrate action secrets to keying to store them more securely (#8692)

Browse source 
- Use the keying module, that was introduced in forgejo/forgejo#5041, to store action secrets safely and securely in the database.
- Introduce a central function that sets the secret, `SetSecret` and let the caller do the update call. This is similar to how the twofactor (TOTP) models does it. Ref. https://codeberg.org/forgejo/forgejo/pulls/6074
- Add a relaxed migration, that is run inside a transaction. If it cannot decrypt a action secret, then it's deleted.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8692
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
This commit is contained in:
Gusted 2025-07-29 01:03:36 +02:00 • committed by Gusted
commit 13e48ead92
9 changed files with 293 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

2
models/forgejo_migrations/migrate.go
View file

@ -115,6 +115,8 @@ var migrations = []*Migration{
NewMigration("Add `branch_filter` to `push_mirror` table", AddPushMirrorBranchFilter),
// v37 -> v38
NewMigration("Add `resolved_unix` column to `abuse_report` table", AddResolvedUnixToAbuseReport),
// v38 -> v39
NewMigration("Migrate `data` column of `secret` table to store keying material", MigrateActionSecretsToKeying),
}
// GetCurrentDBVersion returns the current Forgejo database version.