# Drone Promote User

**URL:** <https://drone.discourse.group/t/drone-promote-user/9519>\
**Category:** Drone Support\
**Created:** [October 15, 2020, 11:54am UTC](https://drone.discourse.group/t/drone-promote-user/9519 "2020-10-15T11:54:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sai\_Krishna](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/sai_krishna/32/2654_2.png) [@Sai\_Krishna](https://drone.discourse.group/u/Sai_Krishna)\
**Post date:** [October 15, 2020, 11:54am UTC](https://drone.discourse.group/t/drone-promote-user/9519/1 "2020-10-15T11:54:33Z")

</div>

Drone CD promotes, how can we fetch information related to the Git user who clicked on Deploy. There might be multiple scenarios push happens with git user id but Deploy can be clicked by any user who has access to the Drone CI. How do we know or control the user clicking on the promote button?

---

<div class="post-metadata">

**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\
**Post date:** [October 15, 2020, 1:01pm UTC](https://drone.discourse.group/t/drone-promote-user/9519/2 "2020-10-15T13:01:32Z")

</div>

> [@How can I copy files and change owner?](https://drone.discourse.group/t/how-can-i-copy-files-and-change-owner/8181/1):
>
> There might be multiple scenarios push happens with git user id but Deploy can be clicked by any user who has access to the Drone CI.

deploy cannot be clicked by _anyone_ that has access to Drone. It can only be clicked by a user that has write or admin access to the repository. If you want to further limit who can promote a pipeline, a third party community extension is available that allows you to do so. See [Cannot use CLI without access\_token](http://discuss.harness.io/t/promote-auth-extension/8043)

---

<div class="post-metadata">

**Author:** ![Sai\_Krishna](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/sai_krishna/32/2654_2.png) [@Sai\_Krishna](https://drone.discourse.group/u/Sai_Krishna)\
**Post date:** [October 15, 2020, 1:08pm UTC](https://drone.discourse.group/t/drone-promote-user/9519/3 "2020-10-15T13:08:21Z")

</div>

Thanks for the help. Is there a way to find out the GitHub/Git user who has write permissions to the repository and click on deploy/promote for auditing purposes?

---

<div class="post-metadata">

**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\
**Post date:** [October 15, 2020, 1:16pm UTC](https://drone.discourse.group/t/drone-promote-user/9519/4 "2020-10-15T13:16:53Z")

</div>

> [@How can I copy files and change owner?](https://drone.discourse.group/t/how-can-i-copy-files-and-change-owner/8181/3):
>
> Is there a way to find out the GitHub/Git user who has write permissions

Drone inherits the permissions from GitHub. So anyone that has write or admin access to your repository in GitHub will have write or admin access to the repository in Drone. You can therefore query GitHub to get a list of all users with write or admin access, or you can use the following API endpoint in Drone to get a list of user permissions:

```plaintext
GET /api/repos/{owner}/{repo}/builds//collaborators

```

> [@How can I copy files and change owner?](https://drone.discourse.group/t/how-can-i-copy-files-and-change-owner/8181/3):
>
> click on deploy/promote for auditing purposes?

When a user clicks the promote button, their username is captured and stored in the database in the `trigger` field, which you can view using the following API endpoint:

```plaintext
GET /api/repos/{owner}/{repo}/builds/{build}

```