Update netrc option description

docs/docs/20-usage/75-project-settings.md

@@ -42,7 +42,14 @@ Only server admins can set this option. If you are not a server admin this optio
 
 ## Only inject netrc credentials into trusted containers
 
-Cloning pipeline step may need git credentials. They are injected via netrc. By default, they're only injected if this option is enabled, the repo is trusted ([see above](#trusted)) or the image is a trusted clone image. If you uncheck the option, git credentials will be injected into any container in clone step.
+The "clone" step may need git credentials (e.g. for private repos).
+These are injected via `netrc`.
+By default, they're only injected into "trusted" clone plugins listed in env var `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+If this option is unchecked, git credentials will be injected into any plugin used in the clone step, regardless of being listed in `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+
+:::note
+This option does not have any effect for other steps than the "clone" step.
+:::
 
 ## Project visibility
 

docs/versioned_docs/version-1.0/20-usage/71-project-settings.md

@@ -35,7 +35,14 @@ Only server admins can set this option. If you are not a server admin this optio
 
 ### Only inject netrc credentials into trusted containers
 
-Cloning pipeline step may need git credentials. They are injected via netrc. By default, they're only injected if this option is enabled, the repo is trusted ([see above](#trusted)) or the image is a trusted clone image. If you uncheck the option, git credentials will be injected into any container in clone step.
+The "clone" step may need git credentials (e.g. for private repos).
+These are injected via `netrc`.
+By default, they're only injected into "trusted" clone plugins listed in env var `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+If this option is unchecked, git credentials will be injected into any plugin used in the clone step, regardless of being listed in `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+
+:::note
+This option does not have any effect for other steps than the "clone" step.
+:::
 
 ## Project visibility
 

docs/versioned_docs/version-2.5/20-usage/75-project-settings.md

@@ -42,7 +42,14 @@ Only server admins can set this option. If you are not a server admin this optio
 
 ## Only inject netrc credentials into trusted containers
 
-Cloning pipeline step may need git credentials. They are injected via netrc. By default, they're only injected if this option is enabled, the repo is trusted ([see above](#trusted)) or the image is a trusted clone image. If you uncheck the option, git credentials will be injected into any container in clone step.
+The "clone" step may need git credentials (e.g. for private repos).
+These are injected via `netrc`.
+By default, they're only injected into "trusted" clone plugins listed in env var `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+If this option is unchecked, git credentials will be injected into any plugin used in the clone step, regardless of being listed in `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+
+:::note
+This option does not have any effect for other steps than the "clone" step.
+:::
 
 ## Project visibility
 

docs/versioned_docs/version-2.6/20-usage/75-project-settings.md

@@ -42,7 +42,14 @@ Only server admins can set this option. If you are not a server admin this optio
 
 ## Only inject netrc credentials into trusted containers
 
-Cloning pipeline step may need git credentials. They are injected via netrc. By default, they're only injected if this option is enabled, the repo is trusted ([see above](#trusted)) or the image is a trusted clone image. If you uncheck the option, git credentials will be injected into any container in clone step.
+The "clone" step may need git credentials (e.g. for private repos).
+These are injected via `netrc`.
+By default, they're only injected into "trusted" clone plugins listed in env var `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+If this option is unchecked, git credentials will be injected into any plugin used in the clone step, regardless of being listed in `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+
+:::note
+This option does not have any effect for other steps than the "clone" step.
+:::
 
 ## Project visibility
 

docs/versioned_docs/version-2.7/20-usage/75-project-settings.md

@@ -42,7 +42,14 @@ Only server admins can set this option. If you are not a server admin this optio
 
 ## Only inject netrc credentials into trusted containers
 
-Cloning pipeline step may need git credentials. They are injected via netrc. By default, they're only injected if this option is enabled, the repo is trusted ([see above](#trusted)) or the image is a trusted clone image. If you uncheck the option, git credentials will be injected into any container in clone step.
+The "clone" step may need git credentials (e.g. for private repos).
+These are injected via `netrc`.
+By default, they're only injected into "trusted" clone plugins listed in env var `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+If this option is unchecked, git credentials will be injected into any plugin used in the clone step, regardless of being listed in `WOODPECKER_PLUGINS_TRUSTED_CLONE`.
+
+:::note
+This option does not have any effect for other steps than the "clone" step.
+:::
 
 ## Project visibility
 

web/src/assets/locales/en.json

@@ -93,8 +93,8 @@
           "desc": "Every pipeline needs to be approved before being executed."
         },
         "netrc_only_trusted": {
-          "netrc_only_trusted": "Only inject netrc credentials into trusted containers",
-          "desc": "Only inject netrc credentials into trusted containers (recommended)."
+          "netrc_only_trusted": "Only inject netrc credentials into trusted clone step plugins.",
+          "desc": "If checked, git netrc credentials will only be available to plugins listed in env var `WOODPECKER_PLUGINS_TRUSTED_CLONE`. netrc credentials are required for a functional clone operation. If unchecked, this will allow untrusted clone plugins in the clone step to function properly. This option does not have effect for non-clone steps."
         },
         "trusted": {
           "trusted": "Trusted",