- Notifications
You must be signed in to change notification settings - Fork1.1k
fix(coderd): disallow POSTing a workspace build on a deleted workspace#20584
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
deansheather commentedOct 30, 2025
I think allowing extra
There are no other ways for a workspace to become Obviously, if someone uploaded a custom state on their build the story is a bit different, which is why I think it's fine to leave it in the API. But I don't think anyone will ever need to do it so I don't think we should add it to the CLI/UI. |
3801701 intomainUh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
Problem
It looks like, for a good long while, we have allows POSTing a workspace build on a deleted workspace. As far as I can tell, this goesway back (to at least 2.21, but maybe earlier).
Credit to@DanielleMaywood
Impact
Proposed Solution
This PR adds a check on
/api/v2/workspacebuildsto disallow creating a START or STOP build if the workspace is deleted. I elected to allow a DELETE build however.Remediation
I haven't added any automatic remediation, but below is a (Claude-coded) SQL query that should show affected workspaces and associated resources: