{"action":"created","issue":{"url":"https://api.github.com/repos/drone/drone/issues/1408","labels_url":"https://api.github.com/repos/drone/drone/issues/1408/labels{/name}","comments_url":"https://api.github.com/repos/drone/drone/issues/1408/comments","events_url":"https://api.github.com/repos/drone/drone/issues/1408/events","html_url":"https://github.com/drone/drone/issues/1408","id":126064730,"number":1408,"title":"no warning when .drone.sec checksum is invalid","user":{"login":"ryane","id":7346,"avatar_url":"https://avatars.githubusercontent.com/u/7346?v=3","gravatar_id":"","url":"https://api.github.com/users/ryane","html_url":"https://github.com/ryane","followers_url":"https://api.github.com/users/ryane/followers","following_url":"https://api.github.com/users/ryane/following{/other_user}","gists_url":"https://api.github.com/users/ryane/gists{/gist_id}","starred_url":"https://api.github.com/users/ryane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryane/subscriptions","organizations_url":"https://api.github.com/users/ryane/orgs","repos_url":"https://api.github.com/users/ryane/repos","events_url":"https://api.github.com/users/ryane/events{/privacy}","received_events_url":"https://api.github.com/users/ryane/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-11T23:47:05Z","updated_at":"2016-01-12T00:29:14Z","closed_at":"2016-01-12T00:29:14Z","body":"It would be nice if there was some kind of warning to advise you when you pushed a new .drone.yml without re-running `drone secure` [1] to update the checksum.\r\n\r\nThe scenario: I had an existing `publish` section in my .drone.yml that used the docker plugin to push an image to docker hub. It used secrets encrypted in .drone.sec and it was working correctly. I added another `publish` section to trigger a push with a different tag when the repo was tagged. After pushing the change, drone ran and reported a successful build. However, I noticed no new docker images were published. When I looked at the build logs, I saw that the build step completed but none of the publish tasks ran. \r\n\r\nAfter much troubleshooting, I remembered I had forgotten to run `drone secure` after updating .drone.yml. I did that and subsequent builds successfully ran my publish steps.\r\n\r\nI don't know if the build should fail in this scenario but I feel like there should at least be a warning somewhere indicating that the checksum didn't match. Right now, drone reports a successful build and just silently skips the publish steps.\r\n\r\n[1] `drone secure --repo user/repo --in ./secrets.yml --yaml .drone.yml --checksum`, for example"},"comment":{"url":"https://api.github.com/repos/drone/drone/issues/comments/170742227","html_url":"https://github.com/drone/drone/issues/1408#issuecomment-170742227","issue_url":"https://api.github.com/repos/drone/drone/issues/1408","id":170742227,"user":{"login":"bradrydzewski","id":817538,"avatar_url":"https://avatars.githubusercontent.com/u/817538?v=3","gravatar_id":"","url":"https://api.github.com/users/bradrydzewski","html_url":"https://github.com/bradrydzewski","followers_url":"https://api.github.com/users/bradrydzewski/followers","following_url":"https://api.github.com/users/bradrydzewski/following{/other_user}","gists_url":"https://api.github.com/users/bradrydzewski/gists{/gist_id}","starred_url":"https://api.github.com/users/bradrydzewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradrydzewski/subscriptions","organizations_url":"https://api.github.com/users/bradrydzewski/orgs","repos_url":"https://api.github.com/users/bradrydzewski/repos","events_url":"https://api.github.com/users/bradrydzewski/events{/privacy}","received_events_url":"https://api.github.com/users/bradrydzewski/received_events","type":"User","site_admin":false},"created_at":"2016-01-12T00:29:14Z","updated_at":"2016-01-12T00:29:14Z","body":"I ran into the same issue today. You can add `debug: true` which does output useful debugging day and would have surfaced this error. I just pushed a quick change that will display the error by default, without having to enable debug mode.\r\n\r\n> I don't know if the build should fail in this scenario but I feel like there should at least be a warning somewhere indicating that the checksum didn't match\r\n\r\nSince you asked, and because others may have the same question ...\r\n\r\nThe reason we don't fail the build is because we want the ability to test pull requests even if the yaml changes. In some cases, especially with public repositories, the pull request author may not have the ability to generate a new `.drone.sec` file. This avoids a chicken-and-egg issue where the maintainer cannot merge the pull requests until tests are run, but the tests cannot be run until the `.drone.sec` has a valid checksum."}}