# Controlling builds for public repos **URL:** \ **Category:** Drone Support\ **Created:** [August 26, 2020, 6:01pm UTC](https://drone.discourse.group/t/controlling-builds-for-public-repos/10585 "2020-08-26T18:01:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![mattlqx](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/mattlqx/32/5042_2.png) [@mattlqx](https://drone.discourse.group/u/mattlqx)\ **Post date:** [August 26, 2020, 6:01pm UTC](https://drone.discourse.group/t/controlling-builds-for-public-repos/10585/1 "2020-08-26T18:01:17Z")
I see in older version of Drone there was a [“gatekeeper” endpoint](http://discuss.harness.io/t/global-flag-for-disabling-pull-request-builds-coming-from-forked-repos/1105/4) that could control blocking of a build. Has that feature been completely removed? I work with primarily private repos in our org so much of our Drone pipelines were built around everything being trusted since we use private Docker, RubyGems and NPM repositories so secrets need to be available even during a pull\_request build. If I wanted to use the existing process on a public repository, I’d have to disable fork builds and then I don’t think I’d have any option for a trusted org user to build that pull. I think Drone’s official position is that if a repository is public, to build the pull all images on all steps should be public and use no secrets. It still seems like any repo being built with an in-repo Dockerfile could still abuse this process to execute arbitrary commands inside your CI cluster even with a protected .drone.yml. So it seems to me, that a manual build block is still the best option. Are there any options presently available to implement forked PR blocking with the ability of a trusted user to approve them? ---
**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\ **Post date:** [August 26, 2020, 6:30pm UTC](https://drone.discourse.group/t/controlling-builds-for-public-repos/10585/2 "2020-08-26T18:30:05Z")
You could create and use a validation extension. The purpose of a validation extension is to evaluate incoming webhook data and yaml configuration and decide whether or not to proceed with execution. [https://docs.drone.io/extensions/validation/](https://docs.drone.io/extensions/validation/) _EDIT: this requires the latest Drone image and you will need to update the [drone-go](https://github.com/drone/boilr-validate/blob/master/template/go.mod#L6) library in the validation extension starter project using go get. In order to block the pipeline, you can [return](https://github.com/drone/boilr-validate/blob/master/template/plugin/plugin.go#L40) validator.ErrBlock from the extension._ ---
**Author:** ![mattlqx](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/mattlqx/32/5042_2.png) [@mattlqx](https://drone.discourse.group/u/mattlqx)\ **Post date:** [August 26, 2020, 7:57pm UTC](https://drone.discourse.group/t/controlling-builds-for-public-repos/10585/3 "2020-08-26T19:57:44Z")
Thanks, Brad. I should be able to figure it out from that. 👍🏻 ---
**Author:** ![teleport-walt](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/teleport-walt/32/3333_2.png) [@teleport-walt](https://drone.discourse.group/u/teleport-walt)\ **Post date:** [May 13, 2021, 6:48pm UTC](https://drone.discourse.group/t/controlling-builds-for-public-repos/10585/4 "2021-05-13T18:48:16Z")
I just wrote a Drone validation extension that will force approval of all pull requests coming from forks: > **[wadells/drone-fork-approval-extension](https://github.com/wadells/drone-fork-approval-extension)** > > Drone extension to force build approval on pull requests from forks. It could be a good template for your own.