Recent changes to Webhooks

Webhooks modified by Heith Seewald

Heith Seewald — Tue, 21 Jul 2015 17:08:08 -0000

--- v8
+++ v9
@@ -150,7 +150,7 @@
 The signature is obtained by hashing the webhook payload with `secret` using HMAC algorithm. You can do something like this to verify it:

     :::python
-    def verify(payload, signature, secret)
+    def verify(payload, signature, secret):
         actual_signature = hmac.new(secret.encode('utf-8'), payload.encode('utf-8'), hashlib.sha1)
         actual_signature = 'sha1=' + actual_signature.hexdigest()
         return hmac.compare_digest(actual_signature, signature)

Webhooks modified by Dave Brondsema

Dave Brondsema — Tue, 10 Mar 2015 19:27:37 -0000

--- v7
+++ v8
@@ -50,7 +50,7 @@
     "repository": {
       "full_name": "/p/test/git/", 
       "name": "Git", 
-      "url": "sourceforge.net/p/test/git/"
+      "url": "http://sourceforge.net/p/test/git/"
     }
 }
 ~~~~~

Webhooks modified by Igor Bondarenko

Igor Bondarenko — Mon, 23 Feb 2015 20:19:36 -0000

--- v6
+++ v7
@@ -140,7 +140,7 @@

 ## Receiving webhooks

-If you want to make sure that requests are coming Allura and not from someone else, you need to:
+If you want to make sure that requests are coming from Allura and not from someone else, you need to:

 - Set up `secret` when configuring the webhook (you can leave it blank and Allura will automatically generate one for you).
 - On every request validate the signature from the `X-Allura-Signature` header.

Webhooks modified by Dave Brondsema

Dave Brondsema — Mon, 23 Feb 2015 19:37:24 -0000

--- v5
+++ v6
@@ -63,7 +63,7 @@
 {
     "after": "3f36d4136f4c7151066135335a70d812f7d9251b", 
     "before": "715226c07bcfd410bb655e9290adeb770eb36b1f", 
-    "size": 1
+    "size": 1,
     "commits": [
       {
         "id": "3f36d4136f4c7151066135335a70d812f7d9251b", 
@@ -105,7 +105,7 @@
 {
     "after": "r10", 
     "before": "r9", 
-    "size": 1
+    "size": 1,
     "commits": [
       {
         "id": "r10",

Webhooks modified by Dave Brondsema

Dave Brondsema — Mon, 23 Feb 2015 19:36:00 -0000

--- v4
+++ v5
@@ -1,6 +1,6 @@
 [TOC]

-Allura supports one type of webhooks for the moment - `repo-push`, triggered when repository receives new commits. It is supported for Git, Mercurial and SVN repositories.
+Allura supports one type of webhook for the moment - `repo-push`, triggered when a repository receives new commits. It is supported for Git, Mercurial and SVN repositories.

 ## Configure webhooks

@@ -9,11 +9,11 @@
 - Click 'Create' under appropriate hook type
 - Provide url and (optional) secret

-You can also manage webhooks through [REST API](https://sourceforge.net/p/forge/documentation/Allura%20API/).
+You can also manage webhooks through the         [REST API](https://sourceforge.net/p/forge/documentation/Allura%20API/).

 ## Payload

-Request payload is JSON.
+The request payload is JSON.  Examples:

 ### Git

@@ -55,7 +55,7 @@
 }
 ~~~~~

-.
+


 ### Mercurial

@@ -97,7 +97,7 @@
   }
 ~~~~~

-.
+


 ### SVN

@@ -140,14 +140,14 @@

 ## Receiving webhooks

-If your want to make sure that requests coming Allura and not from someone else you need to:
+If you want to make sure that requests are coming Allura and not from someone else, you need to:

-- Set up `secret` when configuring webhook (you can leave it blank and Allura will automatically generate one for you).
-- On every request validate signature from the `X-Allura-Signature` header.
+- Set up `secret` when configuring the webhook (you can leave it blank and Allura will automatically generate one for you).
+- On every request validate the signature from the `X-Allura-Signature` header.

 Note: **DO NOT** ever expose your `secret`!

-Signature is obtained by hashing webhook payload with `secret` using HMAC algorithm. You can do something like this to verify it:
+The signature is obtained by hashing the webhook payload with `secret` using HMAC algorithm. You can do something like this to verify it:

     :::python
     def verify(payload, signature, secret)

Webhooks modified by Igor Bondarenko

Igor Bondarenko — Mon, 23 Feb 2015 15:14:52 -0000

--- v3
+++ v4
@@ -8,6 +8,8 @@
 - Find 'Webhooks' link under particular repository tool
 - Click 'Create' under appropriate hook type
 - Provide url and (optional) secret
+
+You can also manage webhooks through [REST API](https://sourceforge.net/p/forge/documentation/Allura%20API/).

 ## Payload

Webhooks modified by Igor Bondarenko

Igor Bondarenko — Mon, 23 Feb 2015 15:11:44 -0000

--- v2
+++ v3
@@ -10,6 +10,8 @@
 - Provide url and (optional) secret

 ## Payload
+
+Request payload is JSON.

 ### Git

Webhooks modified by Igor Bondarenko

Igor Bondarenko — Mon, 23 Feb 2015 15:10:37 -0000

--- v1
+++ v2
@@ -150,3 +150,6 @@
         actual_signature = hmac.new(secret.encode('utf-8'), payload.encode('utf-8'), hashlib.sha1)
         actual_signature = 'sha1=' + actual_signature.hexdigest()
         return hmac.compare_digest(actual_signature, signature)
+    
+    
+    verify(request.body, request.headers.get('X-Allura-Signature'), secret)

Webhooks modified by Igor Bondarenko

Igor Bondarenko — Mon, 23 Feb 2015 15:08:22 -0000

Configure webhooks
Payload
- Git
- Mercurial
- SVN
Receiving webhooks

Allura supports one type of webhooks for the moment - repo-push, triggered when repository receives new commits. It is supported for Git, Mercurial and SVN repositories.

Configure webhooks

Go to tools admin page
Find 'Webhooks' link under particular repository tool
Click 'Create' under appropriate hook type
Provide url and (optional) secret

Payload

Git

{
    "after": "a72ab8566ed1a81e485a8451868ee9364069ea6b", 
    "before": "27bc571ceb56beeda796e0069bfba84581f55770",
    "size": 1,
    "commits": [
      {
        "id": "a72ab8566ed1a81e485a8451868ee9364069ea6b", 
        "message": "Update README", 
        "added": [], 
        "copied": [], 
        "removed": [], 
        "modified": [
          "README.md"
        ], 
        "author": {
          "email": "jetmind@example.com", 
          "name": "Igor Bondarenko", 
          "username": "jetmind"
        }, 
        "committer": {
          "email": "jetmind@example.com", 
          "name": "Igor Bondarenko", 
          "username": "jetmind"
        }, 
        "timestamp": "2015-02-23T14:30:42Z", 
        "url": "http://sourceforge.net/p/test/git/ci/a72ab8566ed1a81e485a8451868ee9364069ea6b/"
      }
    ], 
    "ref": "refs/heads/master", 
    "repository": {
      "full_name": "/p/test/git/", 
      "name": "Git", 
      "url": "sourceforge.net/p/test/git/"
    }
}

Mercurial

{
    "after": "3f36d4136f4c7151066135335a70d812f7d9251b", 
    "before": "715226c07bcfd410bb655e9290adeb770eb36b1f", 
    "size": 1
    "commits": [
      {
        "id": "3f36d4136f4c7151066135335a70d812f7d9251b", 
        "message": "Update README", 
        "added": [], 
        "copied": [], 
        "removed": [], 
        "modified": [
          "README.markdown"
        ], 
        "author": {
          "email": "jetmind", 
          "name": "jetmind", 
          "username": ""
        }, 
        "committer": {
          "email": "jetmind", 
          "name": "jetmind", 
          "username": ""
        }, 
        "timestamp": "2015-02-23T14:32:01Z", 
        "url": "http://sourceforge.net/p/test/mercurial/ci/3f36d4136f4c7151066135335a70d812f7d9251b/"
      }
    ], 
    "ref": "refs/tags/tip", 
    "repository": {
      "full_name": "/p/test/mercurial/", 
      "name": "Mercurial", 
      "url": "http://sourceforge.net/p/test/mercurial/"
    }
  }

SVN

{
    "after": "r10", 
    "before": "r9", 
    "size": 1
    "commits": [
      {
        "id": "r10", 
        "message": "Update README", 
        "added": [], 
        "copied": [],
        "removed": [], 
        "modified": [
          "/trunk/README"
        ], 
        "author": {
          "email": "", 
          "name": "jetmind", 
          "username": ""
        }, 
        "committer": {
          "email": "", 
          "name": "jetmind", 
          "username": ""
        },  
        "timestamp": "2015-02-23T14:33:40Z", 
        "url": "http://sourceforge.net/p/test/svn/10/"
      }
    ], 
    "repository": {
      "full_name": "/p/test/svn/", 
      "name": "SVN", 
      "url": "http://sourceforge.net/p/test/svn/"
    }
  }

Receiving webhooks

If your want to make sure that requests coming Allura and not from someone else you need to:

Set up secret when configuring webhook (you can leave it blank and Allura will automatically generate one for you).
On every request validate signature from the X-Allura-Signature header.

Note: DO NOT ever expose your secret!

Signature is obtained by hashing webhook payload with secret using HMAC algorithm. You can do something like this to verify it:

def verify(payload, signature, secret)
    actual_signature = hmac.new(secret.encode('utf-8'), payload.encode('utf-8'), hashlib.sha1)
    actual_signature = 'sha1=' + actual_signature.hexdigest()
    return hmac.compare_digest(actual_signature, signature)