Gitea Build Pipeline
You set up a gitea build pipeline by adding a workflow file and linking a runner. The runner reads your workflow steps and runs jobs when someone pushes code. Teams often store shared cloud keys and database passwords inside the repo secret store. This habit gives every build job full power over live systems. If a bad script runs in a pull request, it can read or drop live data. How a gitea build pipeline works in practice Gitea Actions is the built-in tool that runs your automated jobs. It
DevSecOps Pipeline Design + Build Provenance (SLSA): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up a gitea build pipeline by adding a workflow file and linking a runner. The runner reads your workflow steps and runs jobs when someone pushes code.
Teams often store shared cloud keys and database passwords inside the repo secret store. This habit gives every build job full power over live systems. If a bad script runs in a pull request, it can read or drop live data.
How a gitea build pipeline works in practice
Gitea Actions is the built-in tool that runs your automated jobs. It uses an external worker program called a runner to do the heavy work. You install the runner on a server or inside a container. Then you register it with your Gitea server using a registration token.
You can link runners at the whole server level, the team level, or the repo level. Once linked, the runner polls the Gitea server for new jobs. Developers define these jobs by placing a workflow file inside the repo.
Each workflow file lists the events that start a run, like a code push. When that event happens, Gitea sends the job steps and repo secrets to the runner. The runner spins up clean containers to test, build, and deploy your app.
What native runner permissions solve and what they miss
Native Gitea settings let you control who can edit code and trigger workflows. You can require reviews before a pull request runs on a shared runner. You can also split secrets by repo so one app cannot read another app's keys.
Still, native runner settings only decide which job gets the secret key. Once the job starts, the runner hands the raw password or key to the build script. The native tool does not watch what the script does with that key in flight.
DevSecOps Pipeline Design + Build Provenance (SLSA): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
A build job with a database password can run any query that role allows. If that role has write power, a broken migration script can wipe a table. If the script prints query results to the build log, private data can leak. Masking tools that rewrite emails, phone numbers, card numbers, and national IDs are not built in. Teams also lack a clear audit log showing which exact command ran on the target server.
Best practices for securing your build runners
Start by keeping your runners isolated from your main production network when you can. Use container mode so each job starts in a fresh, clean workspace. Wipe the workspace after every run so old files and keys do not stay behind.
Avoid registering one giant runner for every team and project on your server. Instead, give sensitive repos their own dedicated runners with strict network rules. Scope your secrets to the smallest possible group rather than the whole server.
Review third-party workflow actions before you let your team use them in builds. Pin those external actions to an exact commit hash instead of a moving version tag. This stops an attacker from pushing bad code into a shared action your build trusts.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
How do I connect a runner to my Gitea server?
First, copy the registration token from your repo, team, or server settings page. Then run the registration step on your worker host so it can poll for jobs.
Where should I store secrets for a gitea build pipeline?
Store secrets at the repo level whenever you can to limit their reach. Only use team or server secrets when many repos truly need the exact same key.
Can a pull request from a fork read my repo secrets?
By default, Gitea blocks workflows from untrusted forks from reading your stored repo secrets. You should still check code changes before you approve a pull request to run.