let them run job base on a specific commit but not the source code

If user can access commit info to run job, they have some info of the source, why not let them accessing source then.

enable/disable notification based on job query

you can subscribe to a build query to get notifications:

If user can access commit info to run job, they have some info of the source, why not let them accessing source then.

Well, that's the point !

The only place where they can run an old job is in the commit page. So they have to list the commit and commit message but NOT the source as i don't want they exfiltrate source code.

I personally feel that it is not very reasonable to have users seen commits (which is necessary to run build against), but not being able to see source. Sometimes, it is even necessary to check source of the commit to make sure the job is running against right commit...

This is for helpdesk support, they don't have the knowledge to read source code instead they read the commit message to take a decision and run the associated job.

But only owner and dev can access source code for security reason.

Will improve so that user can choose commit to build against in builds page.

Trying to implement this, feature but turns out this feature is flawed. For instance, to find out appropriate commits to build against, OneDev may need to be able to search commits by author/file, and may also need to show branches/tags, and this discloses much of source info.

Due to this, I'd like not to implement this feature. Instead the role editing page will be improved to make sure code read privilege is also specified if job run privilege is specified.

I understand, thanks