Allow to disable deployments (#3570)

…but if they're enabled, allow for all events. Also add warning that you
should only enable it if you trust the users with push access.

closes #3559

---------

Co-authored-by: Robert Kaussow <xoxys@rknet.org>

web/src/assets/locales/en.json

@@ -90,6 +90,10 @@
           "allow": "Allow Pull Requests",
           "desc": "Pipelines can run on pull requests."
         },
+        "allow_deploy": {
+          "allow": "Allow deployments",
+          "desc": "Allow deployments from successful pipelines. Only use if you trust all users with push access."
+        },
         "protected": {
           "protected": "Protected",
           "desc": "Every pipeline needs to be approved before being executed."

web/src/components/repo/settings/GeneralTab.vue

@@ -29,6 +29,11 @@
           :label="$t('repo.settings.general.allow_pr.allow')"
           :description="$t('repo.settings.general.allow_pr.desc')"
         />
+        <Checkbox
+          v-model="repoSettings.allow_deploy"
+          :label="$t('repo.settings.general.allow_deploy.allow')"
+          :description="$t('repo.settings.general.allow_deploy.desc')"
+        />
         <Checkbox
           v-model="repoSettings.gated"
           :label="$t('repo.settings.general.protected.protected')"
@@ -132,6 +137,7 @@ function loadRepoSettings() {
     gated: repo.value.gated,
     trusted: repo.value.trusted,
     allow_pr: repo.value.allow_pr,
+    allow_deploy: repo.value.allow_deploy,
     cancel_previous_pipeline_events: repo.value.cancel_previous_pipeline_events || [],
     netrc_only_trusted: repo.value.netrc_only_trusted,
   };

web/src/lib/api/types/repo.ts

@@ -56,6 +56,8 @@ export type Repo = {
   // Whether pull requests should trigger a pipeline.
   allow_pr: boolean;
 
+  allow_deploy: boolean;
+
   config_file: string;
 
   visibility: RepoVisibility;
@@ -84,6 +86,7 @@ export type RepoSettings = Pick<
   | 'trusted'
   | 'gated'
   | 'allow_pr'
+  | 'allow_deploy'
   | 'cancel_previous_pipeline_events'
   | 'netrc_only_trusted'
 >;

web/src/views/repo/pipeline/PipelineWrapper.vue

@@ -45,10 +45,7 @@
               @click="restartPipeline"
             />
             <Button
-              v-if="
-                pipeline.status === 'success' &&
-                (pipeline.event === 'push' || pipeline.event === 'tag' || pipeline.event === 'release')
-              "
+              v-if="pipeline.status === 'success' && repo.allow_deploy"
               class="flex-shrink-0"
               :text="$t('repo.pipeline.actions.deploy')"
               @click="showDeployPipelinePopup = true"