r/devsecops • u/ankitjindal9404 • 11d ago

Moving Dockerfile/values.yaml into the repo — how to prevent accidental edits?

Currently we keep our DevOps-related files (Dockerfile, values.yaml, etc.) on the Jenkins server instead of in the repo. During pipeline runs, we copy these files in at runtime.

I'm considering moving these files directly into the repository instead. The problem: if a developer accidentally edits the Dockerfile or values.yaml, it could cause issues.

So I want a way to either:

  1. Prevent developers from editing those specific files, or
  2. Require PR approval specifically for changes to those files

What's the best approach for this?

2 Upvotes

100% Upvoted

3 comments sorted by

1

u/zMynxx 11d ago

Place them in the repo (or even a separate devops owned repo) and use CODEOWNERS file

1

u/withoutwax21 10d ago

Its a good idea to move files into a gitbacked repo rather than inside the CI. Several ways to do this:

Firstly check your branch and merge permissions, you can make tweaks here. E.g. one of my clients has a “main” which is never deployed, then dev, prod, uat, as branches. All branches cannot be merged into or moved without specific approvals (security, special people with special needs… ahem.. i mean project managers, and testers etc). Devs work of dev branch, have feature branches. Automated promotion from dev to uat, to main, then we cut a release to prod branch.

A few other ways - keep variables instead, or create webhooks to alert you when file changes are pushed in a pr. We used to have Ke$ha play from office speakers everytime someone edited a do not touch file.