Skip to content

Get job ID from trusted file

Joe Burnett requested to merge jburnett/job-id-from-file into main

The CUSTOM_ENV_* variables can be overridden by users so we can't trust them. And we use CUSTOM_ENV_CI_JOB_ID (CI_JOB_ID to the user) to key sensitive VM metadata. Instead we should use the trusted JSON serialized JobResponse file: https://docs.gitlab.com/runner/executors/custom.html#job-response

Fixes https://gitlab.com/gitlab-org/security/ci-cd/custom-executor-drivers/autoscaler/-/issues/1

Merge request reports