rules-droneci

Drone pipeline commands detected. Verify that no step interpolates untrusted event payload fields (e.g. commit message, branch name) into shell commands — these fields can be attacker-controlled in pull-request triggered builds and lead to command injection.

RISK: privileged: true in a Drone pipeline step gives the container full access to the host kernel — equivalent to running as root on the CI node. This has been used to escape CI sandboxes and exfiltrate secrets from the host. FIX: Remove privileged: true; if Docker-in-Docker is required, use a rootless DinD image or a dedicated daemon socket.

RISK: Pipelines triggered on pull_request events from untrusted forks can expose secrets if the pipeline uses from_secret references without the 'trusted' repo setting. FIX: Enable 'trusted: true' only on the main repo, not forks; use Drone's allow_failure or a separate signing pipeline for PRs from forks.

RISK: Hardcoding a secret value directly in the .drone.yml file exposes it in version control history permanently. FIX: Use Drone secret references — environment: { MY_SECRET: { from_secret: my_secret_name } } — and store the value in the Drone secrets UI or a Vault plugin.

RISK: Unpinned or ':latest' plugin images in Drone pipelines introduce reproducibility and supply-chain risks — a re-push of the upstream image can silently change pipeline behavior or inject malicious code. FIX: Pin all images to an explicit version tag or SHA digest: image: plugins/s3:1.1.0.