Only allow to deploy from push, tag and release (#3522)

server/api/pipeline.go

@@ -409,12 +409,19 @@ func PostPipeline(c *gin.Context) {
 	// make Deploy overridable
 	pl.Deploy = c.DefaultQuery("deploy_to", pl.Deploy)
 
-	// make Event overridable
+	// make Event overridable to deploy
+	// TODO refactor to use own proper API for deploy
 	if event, ok := c.GetQuery("event"); ok {
+		// only allow deploy from push, tag and release
+		if pl.Event != model.EventPush && pl.Event != model.EventTag && pl.Event != model.EventRelease {
+			_ = c.AbortWithError(http.StatusBadRequest, fmt.Errorf("can only deploy push, tag and release pipelines"))
+			return
+		}
+
 		pl.Event = model.WebhookEvent(event)
 
-		if err := pl.Event.Validate(); err != nil {
-			_ = c.AbortWithError(http.StatusBadRequest, err)
+		if pl.Event != model.EventDeploy {
+			_ = c.AbortWithError(http.StatusBadRequest, model.ErrInvalidWebhookEvent)
 			return
 		}
 	}

web/src/views/repo/pipeline/PipelineWrapper.vue

@@ -45,7 +45,10 @@
               @click="restartPipeline"
             />
             <Button
-              v-if="pipeline.status === 'success'"
+              v-if="
+                pipeline.status === 'success' &&
+                (pipeline.event === 'push' || pipeline.event === 'tag' || pipeline.event === 'release')
+              "
               class="flex-shrink-0"
               :text="$t('repo.pipeline.actions.deploy')"
               @click="showDeployPipelinePopup = true"