Enable configuration for no local hook or plugin failure behavours

agent/agent_configuration.go

@@ -36,6 +36,8 @@ type AgentConfiguration struct {
 	StrictSingleHooks           bool
 	RunInPty                    bool
 	KubernetesExec              bool
+	LocalHooksFailureBehavior   string
+	PluginsFailureBehavior      string
 
 	SigningJWKSFile  string // Where to find the key to sign pipeline uploads with (passed through to jobs, they might be uploading pipelines)
 	SigningJWKSKeyID string // The key ID to sign pipeline uploads with

agent/job_runner.go

@@ -46,6 +46,9 @@ const (
 
 	VerificationBehaviourWarn  = "warn"
 	VerificationBehaviourBlock = "block"
+
+	DisabledBehaviourWarn  = "warn"
+	DisabledBehaviourError = "error"
 )
 
 // Certain env can only be set by agent configuration.
@@ -490,6 +493,8 @@ func (r *JobRunner) createEnvironment(ctx context.Context) ([]string, error) {
 	env["BUILDKITE_COMMAND_EVAL"] = fmt.Sprintf("%t", r.conf.AgentConfiguration.CommandEval)
 	env["BUILDKITE_PLUGINS_ENABLED"] = fmt.Sprintf("%t", r.conf.AgentConfiguration.PluginsEnabled)
 	env["BUILDKITE_LOCAL_HOOKS_ENABLED"] = fmt.Sprintf("%t", r.conf.AgentConfiguration.LocalHooksEnabled)
+	env["BUILDKITE_LOCAL_HOOKS_FAILURE_BEHAVIOR"] = r.conf.AgentConfiguration.LocalHooksFailureBehavior
+	env["BUILDKITE_PLUGINS_FAILURE_BEHAVIOR"] = r.conf.AgentConfiguration.PluginsFailureBehavior
 	env["BUILDKITE_GIT_CHECKOUT_FLAGS"] = r.conf.AgentConfiguration.GitCheckoutFlags
 	env["BUILDKITE_GIT_CLONE_FLAGS"] = r.conf.AgentConfiguration.GitCloneFlags
 	env["BUILDKITE_GIT_FETCH_FLAGS"] = r.conf.AgentConfiguration.GitFetchFlags

clicommand/agent_start.go

@@ -58,6 +58,8 @@ Example:
 
 var (
 	verificationFailureBehaviors = []string{agent.VerificationBehaviourBlock, agent.VerificationBehaviourWarn}
+	localHooksFailureBehaviors   = []string{agent.VerificationBehaviourBlock, agent.VerificationBehaviourWarn}
+	pluginsFailureBehaviors      = []string{agent.VerificationBehaviourBlock, agent.VerificationBehaviourWarn}
 
 	buildkiteSetEnvironmentVariables = []*regexp.Regexp{
 		regexp.MustCompile("^BUILDKITE$"),
@@ -140,14 +142,16 @@ type AgentStartConfig struct {
 	GitMirrorsSkipUpdate  bool   `cli:"git-mirrors-skip-update"`
 	NoGitSubmodules       bool   `cli:"no-git-submodules"`
 
-	NoSSHKeyscan        bool     `cli:"no-ssh-keyscan"`
-	NoCommandEval       bool     `cli:"no-command-eval"`
-	NoLocalHooks        bool     `cli:"no-local-hooks"`
-	NoPlugins           bool     `cli:"no-plugins"`
-	NoPluginValidation  bool     `cli:"no-plugin-validation"`
-	NoFeatureReporting  bool     `cli:"no-feature-reporting"`
-	AllowedRepositories []string `cli:"allowed-repositories" normalize:"list"`
-	AllowedPlugins      []string `cli:"allowed-plugins" normalize:"list"`
+	NoSSHKeyscan              bool     `cli:"no-ssh-keyscan"`
+	NoCommandEval             bool     `cli:"no-command-eval"`
+	NoLocalHooks              bool     `cli:"no-local-hooks"`
+	NoPlugins                 bool     `cli:"no-plugins"`
+	NoPluginValidation        bool     `cli:"no-plugin-validation"`
+	NoFeatureReporting        bool     `cli:"no-feature-reporting"`
+	AllowedRepositories       []string `cli:"allowed-repositories" normalize:"list"`
+	AllowedPlugins            []string `cli:"allowed-plugins" normalize:"list"`
+	LocalHooksFailureBehavior string   `cli:"local-hooks-failure-behavior"`
+	PluginsFailureBehavior    string   `cli:"plugins-failure-behavior"`
 
 	EnableEnvironmentVariableAllowList bool     `cli:"enable-environment-variable-allowlist"`
 	AllowedEnvironmentVariables        []string `cli:"allowed-environment-variables" normalize:"list"`
@@ -668,6 +672,18 @@ var AgentStartCommand = cli.Command{
 			Usage:  fmt.Sprintf("The behavior when a job is received without a signature. One of: %v. Defaults to %s", verificationFailureBehaviors, agent.VerificationBehaviourBlock),
 			EnvVar: "BUILDKITE_AGENT_JOB_VERIFICATION_NO_SIGNATURE_BEHAVIOR",
 		},
+		cli.StringFlag{
+			Name:   "local-hooks-failure-behavior",
+			Value:  agent.VerificationBehaviourBlock,
+			Usage:  fmt.Sprintf("The behavior when a job is not allowed to run local hooks. One of: %v. Defaults to %s", localHooksFailureBehaviors, agent.DisabledBehaviourError),
+			EnvVar: "BUILDKITE_AGENT_LOCAL_HOOKS_FAILURE_BEHAVIOR",
+		},
+		cli.StringFlag{
+			Name:   "plugins-failure-behavior",
+			Value:  agent.VerificationBehaviourBlock,
+			Usage:  fmt.Sprintf("The behavior when a job is not allowed to run plugins. One of: %v. Defaults to %s", pluginsFailureBehaviors, agent.DisabledBehaviourError),
+			EnvVar: "BUILDKITE_AGENT_PLUGINS_FAILURE_BEHAVIOR",
+		},
 		cli.StringSliceFlag{
 			Name:   "disable-warnings-for",
 			Usage:  "A list of warning IDs to disable",
@@ -927,6 +943,8 @@ var AgentStartCommand = cli.Command{
 			CommandEval:                  !cfg.NoCommandEval,
 			PluginsEnabled:               !cfg.NoPlugins,
 			PluginValidation:             !cfg.NoPluginValidation,
+			LocalHooksFailureBehavior:    cfg.LocalHooksFailureBehavior,
+			PluginsFailureBehavior:       cfg.PluginsFailureBehavior,
 			LocalHooksEnabled:            !cfg.NoLocalHooks,
 			AllowedEnvironmentVariables:  allowedEnvironmentVariables,
 			StrictSingleHooks:            cfg.StrictSingleHooks,

clicommand/bootstrap.go

@@ -81,6 +81,8 @@ type BootstrapConfig struct {
 	PluginValidation             bool     `cli:"plugin-validation"`
 	PluginsAlwaysCloneFresh      bool     `cli:"plugins-always-clone-fresh"`
 	LocalHooksEnabled            bool     `cli:"local-hooks-enabled"`
+	LocalHooksFailureBehavior    string   `cli:"local-hooks-failure-behavior"`
+	PluginsFailureBehavior       string   `cli:"plugins-failure-behavior"`
 	StrictSingleHooks            bool     `cli:"strict-single-hooks"`
 	PTY                          bool     `cli:"pty"`
 	LogLevel                     string   `cli:"log-level"`
@@ -315,6 +317,16 @@ var BootstrapCommand = cli.Command{
 			Usage:  "Allow local hooks to be run",
 			EnvVar: "BUILDKITE_LOCAL_HOOKS_ENABLED",
 		},
+		cli.StringFlag{
+			Name:   "local-hooks-failure-behavior",
+			Usage:  "The behavior when a job is not allowed to run local hooks.",
+			EnvVar: "BUILDKITE_LOCAL_HOOKS_FAILURE_BEHAVIOR",
+		},
+		cli.StringFlag{
+			Name:   "plugins-failure-behavior",
+			Usage:  "The behavior when a job is not allowed to run plugins.",
+			EnvVar: "BUILDKITE_PLUGINS_FAILURE_BEHAVIOR",
+		},
 		cli.BoolTFlag{
 			Name:   "ssh-keyscan",
 			Usage:  "Automatically run ssh-keyscan before checkout",
@@ -443,6 +455,8 @@ var BootstrapCommand = cli.Command{
 			HooksPath:                    cfg.HooksPath,
 			JobID:                        cfg.JobID,
 			LocalHooksEnabled:            cfg.LocalHooksEnabled,
+			LocalHooksFailureBehavior:    cfg.LocalHooksFailureBehavior,
+			PluginsFailureBehavior:       cfg.PluginsFailureBehavior,
 			OrganizationSlug:             cfg.OrganizationSlug,
 			Phases:                       cfg.Phases,
 			PipelineProvider:             cfg.PipelineProvider,

internal/job/config.go

@@ -107,6 +107,12 @@ type ExecutorConfig struct {
 	// Are local hooks enabled?
 	LocalHooksEnabled bool
 
+	// What failure behaviour is configured for local hooks no being allowed to run
+	LocalHooksFailureBehavior string
+
+	// What failure behaviour is configured for plugins no being allowed to run
+	PluginsFailureBehavior string
+
 	// Should we enforce that only one checkout and one command hook are run?
 	StrictSingleHooks bool
 

internal/job/executor.go

@@ -20,6 +20,7 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/buildkite/agent/v3/agent"
 	"github.com/buildkite/agent/v3/agent/plugin"
 	"github.com/buildkite/agent/v3/env"
 	"github.com/buildkite/agent/v3/internal/experiments"
@@ -693,7 +694,11 @@ func (e *Executor) executeLocalHook(ctx context.Context, name string) error {
 	}
 
 	if !localHooksEnabled {
-		return fmt.Errorf("Refusing to run %s, local hooks are disabled", localHookPath)
+		if e.ExecutorConfig.LocalHooksFailureBehavior == agent.DisabledBehaviourError {
+			return fmt.Errorf("Refusing to run %s, local hooks are disabled", localHookPath)
+		}
+
+		e.shell.Warningf("Refusing to run %s, local hooks are disabled", localHookPath)
 	}
 
 	return e.executeHook(ctx, HookConfig{

internal/job/plugin.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/buildkite/agent/v3/agent"
 	"github.com/buildkite/agent/v3/agent/plugin"
 	"github.com/buildkite/agent/v3/internal/job/hook"
 	"github.com/buildkite/agent/v3/internal/utils"
@@ -42,11 +43,19 @@ func (e *Executor) preparePlugins() error {
 	// Check if we can run plugins (disabled via --no-plugins)
 	if !e.ExecutorConfig.PluginsEnabled {
 		if !e.ExecutorConfig.LocalHooksEnabled {
-			return fmt.Errorf("Plugins have been disabled on this agent with `--no-local-hooks`")
+			if e.ExecutorConfig.LocalHooksFailureBehavior == agent.DisabledBehaviourError {
+				return fmt.Errorf("Plugins have been disabled on this agent with `--no-local-hooks`")
+			}
+			e.shell.Logger.Warningf("Plugins have been disabled on this agent with `--no-local-hooks`")
+			return nil
 		} else if !e.ExecutorConfig.CommandEval {
 			return fmt.Errorf("Plugins have been disabled on this agent with `--no-command-eval`")
 		} else {
-			return fmt.Errorf("Plugins have been disabled on this agent with `--no-plugins`")
+			if e.ExecutorConfig.PluginsFailureBehavior == agent.DisabledBehaviourError {
+				return fmt.Errorf("Plugins have been disabled on this agent with `--no-plugins`")
+			}
+			e.shell.Logger.Warningf("Plugins have been disabled on this agent with `--no-plugins`")
+			return nil
 		}
 	}