fix: send the Forgejo webhook secret inside the hook config #32

Merged

Gilles merged 1 commit from fix/webhook-secret-in-config into master

2026-11-01 13:51:17 +00:00

Gilles commented

2026-11-01 13:20:01 +00:00

Owner

Closes #31.

apps.specs.forgejo._hook_config: the hook config, with the secret (config["secret"]); ensure_webhook uses it — Forgejo ignores a top-level "secret", so every hook registered so far has none and all deliveries get a 403.
resend_webhook_config(hook) + manage.py resend_forgejo_webhooks: PATCHes each registered hook's config (URL + its stored secret). To run once after deploying, to repair the three Filao hooks; harmless to run again. A failure on one repo is printed and the others go on.

Test plan

manage.py test — 206 tests OK (the ensure_webhook test now checks the secret is inside config, 2 new for the command)
autopep8 --diff clean, bandit 0 issues
pylint: my local tox env crashes in astroid on apps/specs/models.py (untouched here) — left to the CI
After deploy: docker exec thierryade python manage.py resend_forgejo_webhooks, then a Forgejo test delivery should be accepted

🤖 Generated with Claude Code

https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA

Closes #31. - `apps.specs.forgejo._hook_config`: the hook config, **with** the secret (`config["secret"]`); `ensure_webhook` uses it — Forgejo ignores a top-level `"secret"`, so every hook registered so far has none and all deliveries get a 403. - `resend_webhook_config(hook)` + `manage.py resend_forgejo_webhooks`: PATCHes each registered hook's config (URL + its stored secret). To run once after deploying, to repair the three Filao hooks; harmless to run again. A failure on one repo is printed and the others go on. ## Test plan - [x] `manage.py test` — 206 tests OK (the ensure_webhook test now checks the secret is inside `config`, 2 new for the command) - [x] `autopep8 --diff` clean, `bandit` 0 issues - [ ] `pylint`: my local tox env crashes in astroid on `apps/specs/models.py` (untouched here) — left to the CI - [ ] After deploy: `docker exec thierryade python manage.py resend_forgejo_webhooks`, then a Forgejo test delivery should be accepted 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA

Gilles added 1 commit

2026-11-01 13:20:01 +00:00

fix: send the Forgejo webhook secret inside the hook config

ci / test (pull_request) Successful in 3m38s

Details

ci / e2e (pull_request) Has been skipped

Details

ci / docker (pull_request) Has been skipped

Details

ci / deploy (pull_request) Has been skipped

Details

7c45530ebc

Forgejo ignores a top-level "secret" in the create-hook payload and then
signs deliveries with an empty key, so every delivery failed
verify_webhook_signature. The secret now goes in config (_hook_config),
and the resend_forgejo_webhooks command re-sends each registered hook's
URL and secret to repair the hooks created before.

Closes #31.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA

Gilles added the

bug

label

2026-11-01 13:20:03 +00:00

Gilles commented

2026-11-01 13:23:34 +00:00

Author

Owner