@@ -93,6 +93,11 @@ const (
9393 GHOrganizationFlag = "gh-org"
9494 GHWebhookSecretFlag = "gh-webhook-secret" // nolint: gosec
9595 GHAllowMergeableBypassApply = "gh-allow-mergeable-bypass-apply" // nolint: gosec
96+ GiteaBaseURLFlag = "gitea-base-url"
97+ GiteaTokenFlag = "gitea-token"
98+ GiteaUserFlag = "gitea-user"
99+ GiteaWebhookSecretFlag = "gitea-webhook-secret" // nolint: gosec
100+ GiteaPageSizeFlag = "gitea-page-size"
96101 GitlabHostnameFlag = "gitlab-hostname"
97102 GitlabTokenFlag = "gitlab-token"
98103 GitlabUserFlag = "gitlab-user"
@@ -156,6 +161,8 @@ const (
156161 DefaultExecutableName = "atlantis"
157162 DefaultMarkdownTemplateOverridesDir = "~/.markdown_templates"
158163 DefaultGHHostname = "github.com"
164+ DefaultGiteaBaseURL = "https://gitea.com"
165+ DefaultGiteaPageSize = 30
159166 DefaultGitlabHostname = "gitlab.com"
160167 DefaultLockingDBType = "boltdb"
161168 DefaultLogLevel = "info"
@@ -318,6 +325,22 @@ var stringFlags = map[string]stringFlag{
318325 "This means that an attacker could spoof calls to Atlantis and cause it to perform malicious actions. " +
319326 "Should be specified via the ATLANTIS_GH_WEBHOOK_SECRET environment variable." ,
320327 },
328+ GiteaBaseURLFlag : {
329+ description : "Base URL of Gitea server installation. Must include 'http://' or 'https://'." ,
330+ },
331+ GiteaUserFlag : {
332+ description : "Gitea username of API user." ,
333+ defaultValue : "" ,
334+ },
335+ GiteaTokenFlag : {
336+ description : "Gitea token of API user. Can also be specified via the ATLANTIS_GITEA_TOKEN environment variable." ,
337+ },
338+ GiteaWebhookSecretFlag : {
339+ description : "Optional secret used to validate Gitea webhooks." +
340+ " SECURITY WARNING: If not specified, Atlantis won't be able to validate that the incoming webhook call came from Gitea. " +
341+ "This means that an attacker could spoof calls to Atlantis and cause it to perform malicious actions. " +
342+ "Should be specified via the ATLANTIS_GITEA_WEBHOOK_SECRET environment variable." ,
343+ },
321344 GitlabHostnameFlag : {
322345 description : "Hostname of your GitLab Enterprise installation. If using gitlab.com, no need to set." ,
323346 defaultValue : DefaultGitlabHostname ,
@@ -568,6 +591,10 @@ var intFlags = map[string]intFlag{
568591 " If merge base is further behind than this number of commits from any of branches heads, full fetch will be performed." ,
569592 defaultValue : DefaultCheckoutDepth ,
570593 },
594+ GiteaPageSizeFlag : {
595+ description : "Optional value that specifies the number of results per page to expect from Gitea." ,
596+ defaultValue : DefaultGiteaPageSize ,
597+ },
571598 ParallelPoolSize : {
572599 description : "Max size of the wait group that runs parallel plans and applies (if enabled)." ,
573600 defaultValue : DefaultParallelPoolSize ,
@@ -813,6 +840,12 @@ func (s *ServerCmd) setDefaults(c *server.UserConfig) {
813840 if c .GitlabHostname == "" {
814841 c .GitlabHostname = DefaultGitlabHostname
815842 }
843+ if c .GiteaBaseURL == "" {
844+ c .GiteaBaseURL = DefaultGiteaBaseURL
845+ }
846+ if c .GiteaPageSize == 0 {
847+ c .GiteaPageSize = DefaultGiteaPageSize
848+ }
816849 if c .BitbucketBaseURL == "" {
817850 c .BitbucketBaseURL = DefaultBitbucketBaseURL
818851 }
@@ -885,12 +918,17 @@ func (s *ServerCmd) validate(userConfig server.UserConfig) error {
885918 // The following combinations are valid.
886919 // 1. github user and token set
887920 // 2. github app ID and (key file set or key set)
888- // 3. gitlab user and token set
889- // 4. bitbucket user and token set
890- // 5. azuredevops user and token set
891- // 6. any combination of the above
892- vcsErr := fmt .Errorf ("--%s/--%s or --%s/--%s or --%s/--%s or --%s/--%s or --%s/--%s or --%s/--%s must be set" , GHUserFlag , GHTokenFlag , GHAppIDFlag , GHAppKeyFileFlag , GHAppIDFlag , GHAppKeyFlag , GitlabUserFlag , GitlabTokenFlag , BitbucketUserFlag , BitbucketTokenFlag , ADUserFlag , ADTokenFlag )
893- if ((userConfig .GithubUser == "" ) != (userConfig .GithubToken == "" )) || ((userConfig .GitlabUser == "" ) != (userConfig .GitlabToken == "" )) || ((userConfig .BitbucketUser == "" ) != (userConfig .BitbucketToken == "" )) || ((userConfig .AzureDevopsUser == "" ) != (userConfig .AzureDevopsToken == "" )) {
921+ // 3. gitea user and token set
922+ // 4. gitlab user and token set
923+ // 5. bitbucket user and token set
924+ // 6. azuredevops user and token set
925+ // 7. any combination of the above
926+ vcsErr := fmt .Errorf ("--%s/--%s or --%s/--%s or --%s/--%s or --%s/--%s or --%s/--%s or --%s/--%s or --%s/--%s must be set" , GHUserFlag , GHTokenFlag , GHAppIDFlag , GHAppKeyFileFlag , GHAppIDFlag , GHAppKeyFlag , GiteaUserFlag , GiteaTokenFlag , GitlabUserFlag , GitlabTokenFlag , BitbucketUserFlag , BitbucketTokenFlag , ADUserFlag , ADTokenFlag )
927+ if ((userConfig .GithubUser == "" ) != (userConfig .GithubToken == "" )) ||
928+ ((userConfig .GiteaUser == "" ) != (userConfig .GiteaToken == "" )) ||
929+ ((userConfig .GitlabUser == "" ) != (userConfig .GitlabToken == "" )) ||
930+ ((userConfig .BitbucketUser == "" ) != (userConfig .BitbucketToken == "" )) ||
931+ ((userConfig .AzureDevopsUser == "" ) != (userConfig .AzureDevopsToken == "" )) {
894932 return vcsErr
895933 }
896934 if (userConfig .GithubAppID != 0 ) && ((userConfig .GithubAppKey == "" ) && (userConfig .GithubAppKeyFile == "" )) {
@@ -901,7 +939,7 @@ func (s *ServerCmd) validate(userConfig server.UserConfig) error {
901939 }
902940 // At this point, we know that there can't be a single user/token without
903941 // its partner, but we haven't checked if any user/token is set at all.
904- if userConfig .GithubAppID == 0 && userConfig .GithubUser == "" && userConfig .GitlabUser == "" && userConfig .BitbucketUser == "" && userConfig .AzureDevopsUser == "" {
942+ if userConfig .GithubAppID == 0 && userConfig .GithubUser == "" && userConfig .GiteaUser == "" && userConfig . GitlabUser == "" && userConfig .BitbucketUser == "" && userConfig .AzureDevopsUser == "" {
905943 return vcsErr
906944 }
907945
@@ -924,6 +962,14 @@ func (s *ServerCmd) validate(userConfig server.UserConfig) error {
924962 return fmt .Errorf ("--%s must have http:// or https://, got %q" , BitbucketBaseURLFlag , userConfig .BitbucketBaseURL )
925963 }
926964
965+ parsed , err = url .Parse (userConfig .GiteaBaseURL )
966+ if err != nil {
967+ return fmt .Errorf ("error parsing --%s flag value %q: %s" , GiteaWebhookSecretFlag , userConfig .GiteaBaseURL , err )
968+ }
969+ if parsed .Scheme != "http" && parsed .Scheme != "https" {
970+ return fmt .Errorf ("--%s must have http:// or https://, got %q" , GiteaBaseURLFlag , userConfig .GiteaBaseURL )
971+ }
972+
927973 if userConfig .RepoConfig != "" && userConfig .RepoConfigJSON != "" {
928974 return fmt .Errorf ("cannot use --%s and --%s at the same time" , RepoConfigFlag , RepoConfigJSONFlag )
929975 }
@@ -936,6 +982,8 @@ func (s *ServerCmd) validate(userConfig server.UserConfig) error {
936982 GitlabWebhookSecretFlag : userConfig .GitlabWebhookSecret ,
937983 BitbucketTokenFlag : userConfig .BitbucketToken ,
938984 BitbucketWebhookSecretFlag : userConfig .BitbucketWebhookSecret ,
985+ GiteaTokenFlag : userConfig .GiteaToken ,
986+ GiteaWebhookSecretFlag : userConfig .GiteaWebhookSecret ,
939987 } {
940988 if strings .Contains (token , "\n " ) {
941989 s .Logger .Warn ("--%s contains a newline which is usually unintentional" , name )
@@ -1029,6 +1077,7 @@ func (s *ServerCmd) setVarFileAllowlist(userConfig *server.UserConfig) {
10291077// trimAtSymbolFromUsers trims @ from the front of the github and gitlab usernames
10301078func (s * ServerCmd ) trimAtSymbolFromUsers (userConfig * server.UserConfig ) {
10311079 userConfig .GithubUser = strings .TrimPrefix (userConfig .GithubUser , "@" )
1080+ userConfig .GiteaUser = strings .TrimPrefix (userConfig .GiteaUser , "@" )
10321081 userConfig .GitlabUser = strings .TrimPrefix (userConfig .GitlabUser , "@" )
10331082 userConfig .BitbucketUser = strings .TrimPrefix (userConfig .BitbucketUser , "@" )
10341083 userConfig .AzureDevopsUser = strings .TrimPrefix (userConfig .AzureDevopsUser , "@" )
@@ -1038,6 +1087,9 @@ func (s *ServerCmd) securityWarnings(userConfig *server.UserConfig) {
10381087 if userConfig .GithubUser != "" && userConfig .GithubWebhookSecret == "" && ! s .SilenceOutput {
10391088 s .Logger .Warn ("no GitHub webhook secret set. This could allow attackers to spoof requests from GitHub" )
10401089 }
1090+ if userConfig .GiteaUser != "" && userConfig .GiteaWebhookSecret == "" && ! s .SilenceOutput {
1091+ s .Logger .Warn ("no Gitea webhook secret set. This could allow attackers to spoof requests from Gitea" )
1092+ }
10411093 if userConfig .GitlabUser != "" && userConfig .GitlabWebhookSecret == "" && ! s .SilenceOutput {
10421094 s .Logger .Warn ("no GitLab webhook secret set. This could allow attackers to spoof requests from GitLab" )
10431095 }
0 commit comments