Change protected repo option to selection

[anbraten]

It could be quite helpful to change the protected option to be a selection with three options:

• not protected: run pipelines directly (same as currently disabled protection)
• protect against forks: if a pipeline from a PR of a fork is started wait for approval
• completely protected: always ask for approval

Maybe we should also think about renaming the option to something like: trust level, ...

[qwerty287]

Maybe we could add some more complex options here:

• first time contributors: require approval for users contributing the first time
• once per PR: once a PR is approved once, allow any new commit to run without approval
• for non-maintainers: allow for users which are maintainers of a repo to run without approval (i.e. users that have write access)
• for non-admins: as for non-maintainers, but only allow admins
• on non-default branch: if the commit was not made on the default branch

[gapodo]

Found this when checking before opening a FR, another nice option would be to be able to allow based on event. In combination with the above would be huge, but event allowing to set protected while still auto running tags (as their protection can come from the forge) would be nice.

• based on event allow <selection of events> but protect the rest

[JulienPalard]

I have yet another idea for this one:

• Don't ask if a given set of files has not changed

In some of my repos the CI triggers a make, in some other repos it triggers tox, so just telling « the woodpecker config has not changed though it is safe » is not enough, an attacker could place code in the Makefile.

But if there were a way to tell "The woodpecker config executes code from the Makefile" (either in the project config, or in the .woodpecker.yml file) then there could be a protected repo option like « if the PR does not change the woodpecker config and does not change the sensitive files, then it is safe to run without asking a project owner ».

Maybe a bit complicated :(