razius/github-webhook-handler

A very simple github post-receive web hook handler.

NOTE

I do not maintain this project and it should only be used as an example.

The following might be a better implrementation:

• https://github.com/carlos-jenkins/python-github-webhooks
• https://github.com/bloomberg/python-github-webhook

Flask webhook for Github

A very simple github post-receive web hook handler that executes per default a pull uppon receiving. The executed action is configurable per repository.

It will also verify that the POST request originated from github.com or a defined GitHub Enterprise server. Additionally will ensure that it has a valid signature (only when the key setting is properly configured).

Gettings started

Installation Requirements

Install dependencies found in requirements.txt.

pip install -r requirements.txt

Repository Configuration

Edit repos.json to configure repositories, each repository must be registered under the form GITHUB_USER/REPOSITORY_NAME.

{
    "razius/puppet": {
        "path": "/home/puppet",
        "key": "MyVerySecretKey",
        "action": [["git", "pull", "origin", "master"]]
    },
    "d3non/somerandomexample/branch:live": {
        "path": "/home/exampleapp",
        "key": "MyVerySecretKey",
        "action": [["git", "pull", "origin", "live"],
            ["echo", "execute", "some", "commands", "..."]]
    }
}

Runtime Configuration

Runtime operation is influenced by a set of environment variables which require being set to influence operation. Only REPOS_JSON_PATH is required to be set, as this is required to know how to act on actions from repositories. The remaining variables are optional. USE_PROXYFIX needs to be set to true if being used behind a WSGI proxy, and is not required otherwise. GHE_ADDRESS needs to be set to the IP address of a GitHub Enterprise instance if that is the source of webhooks.

Set environment variable for the repos.json config.

export REPOS_JSON_PATH=/path/to/repos.json

Start the server.

python index.py 80

Start the server with root privileges, if required, while preserving existing environment variables.

sudo -E python index.py 80

Start the server behind a proxy (see: http://flask.pocoo.org/docs/deploying/wsgi-standalone/#proxy-setups)

USE_PROXYFIX=true python index.py 8080

Start the server to be used with a GitHub Enterprise instance.

GHE_ADDRESS=192.0.2.50 python index.py 80

Go to your repository's settings on github.com or your GitHub Enterprise instance and register your public URL under Webhooks & services -> Webhooks.

github-webhook-handler's Issues

Request to have a VALIDATE_SOURCEIP to be used for GitHub Enterprise

In GitHub Enterprise environments where more that 1 IPv4 is assigned to fqdn we should have an option to check VALIDATE_SOURCEIP which upon setting it to false will not validate the source IP address of the request.

error 500 (no idea why)

Some parts removed/replaced by ***
/opt/app is an existent and accessible directory

# ls /opt
app  bin  etc

My repos.json:

{
    "Tarocco/*****": {
        "path": "/opt/app",
        "key": "*****",
        "action": [["echo", "foobar"]]
    },
}

Request:

{
  "ref": "refs/heads/master",
  "before": "*****",
  "after": "*****",
  "created": false,
  "deleted": false,
  "forced": false,
  "base_ref": null,
  "compare": "https://github.com/Tarocco/*****/compare/*****...*****",
  "commits": [
    {
      "id": "*****",
      "tree_id": "*****",
      "distinct": true,
      "message": "test",
      "timestamp": "2018-05-22T02:27:07-07:00",
      "url": "https://github.com/Tarocco/*****/commit/*****",
      "author": {
        "name": "Tarocco",
        "email": "[email protected]",
        "username": "Tarocco"
      },
      "committer": {
        "name": "Tarocco",
        "email": "[email protected]",
        "username": "Tarocco"
      },
      "added": [
        "webhook-test"
      ],
      "removed": [

      ],
      "modified": [

      ]
    }
  ],
  "head_commit": {
    "id": "*****",
    "tree_id": "*****",
    "distinct": true,
    "message": "test",
    "timestamp": "2018-05-22T02:27:07-07:00",
    "url": "https://github.com/Tarocco/*****/commit/*****",
    "author": {
      "name": "Tarocco",
      "email": "[email protected]",
      "username": "Tarocco"
    },
    "committer": {
      "name": "Tarocco",
      "email": "[email protected]",
      "username": "Tarocco"
    },
    "added": [
      "webhook-test"
    ],
    "removed": [

    ],
    "modified": [

    ]
  },
  "repository": {
    "id": *****,
    "name": "*****",
    "full_name": "Tarocco/*****",
    "owner": {
      "name": "Tarocco",
      "email": "[email protected]",
      "login": "Tarocco",
      "id": *****,
      "avatar_url": "https://avatars0.githubusercontent.com/u/*****?v=4",
      "gravatar_id": "",
      "url": "https://api.github.com/users/Tarocco",
      "html_url": "https://github.com/Tarocco",
      "followers_url": "https://api.github.com/users/Tarocco/followers",
      "following_url": "https://api.github.com/users/Tarocco/following{/other_user}",
      "gists_url": "https://api.github.com/users/Tarocco/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/Tarocco/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/Tarocco/subscriptions",
      "organizations_url": "https://api.github.com/users/Tarocco/orgs",
      "repos_url": "https://api.github.com/users/Tarocco/repos",
      "events_url": "https://api.github.com/users/Tarocco/events{/privacy}",
      "received_events_url": "https://api.github.com/users/Tarocco/received_events",
      "type": "User",
      "site_admin": false
    },
    "private": true,
    "html_url": "https://github.com/Tarocco/*****",
    "description": null,
    "fork": false,
    "url": "https://github.com/Tarocco/*****",
    "forks_url": "https://api.github.com/repos/Tarocco/*****/forks",
    "keys_url": "https://api.github.com/repos/Tarocco/*****/keys{/key_id}",
    "collaborators_url": "https://api.github.com/repos/Tarocco/*****/collaborators{/collaborator}",
    "teams_url": "https://api.github.com/repos/Tarocco/*****/teams",
    "hooks_url": "https://api.github.com/repos/Tarocco/*****/hooks",
    "issue_events_url": "https://api.github.com/repos/Tarocco/*****/issues/events{/number}",
    "events_url": "https://api.github.com/repos/Tarocco/*****/events",
    "assignees_url": "https://api.github.com/repos/Tarocco/*****/assignees{/user}",
    "branches_url": "https://api.github.com/repos/Tarocco/*****/branches{/branch}",
    "tags_url": "https://api.github.com/repos/Tarocco/*****/tags",
    "blobs_url": "https://api.github.com/repos/Tarocco/*****/git/blobs{/sha}",
    "git_tags_url": "https://api.github.com/repos/Tarocco/*****/git/tags{/sha}",
    "git_refs_url": "https://api.github.com/repos/Tarocco/*****/git/refs{/sha}",
    "trees_url": "https://api.github.com/repos/Tarocco/*****/git/trees{/sha}",
    "statuses_url": "https://api.github.com/repos/Tarocco/*****/statuses/{sha}",
    "languages_url": "https://api.github.com/repos/Tarocco/*****/languages",
    "stargazers_url": "https://api.github.com/repos/Tarocco/*****/stargazers",
    "contributors_url": "https://api.github.com/repos/Tarocco/*****/contributors",
    "subscribers_url": "https://api.github.com/repos/Tarocco/*****/subscribers",
    "subscription_url": "https://api.github.com/repos/Tarocco/*****/subscription",
    "commits_url": "https://api.github.com/repos/Tarocco/*****/commits{/sha}",
    "git_commits_url": "https://api.github.com/repos/Tarocco/*****/git/commits{/sha}",
    "comments_url": "https://api.github.com/repos/Tarocco/*****/comments{/number}",
    "issue_comment_url": "https://api.github.com/repos/Tarocco/*****/issues/comments{/number}",
    "contents_url": "https://api.github.com/repos/Tarocco/*****/contents/{+path}",
    "compare_url": "https://api.github.com/repos/Tarocco/*****/compare/{base}...{head}",
    "merges_url": "https://api.github.com/repos/Tarocco/*****/merges",
    "archive_url": "https://api.github.com/repos/Tarocco/*****/{archive_format}{/ref}",
    "downloads_url": "https://api.github.com/repos/Tarocco/*****/downloads",
    "issues_url": "https://api.github.com/repos/Tarocco/*****/issues{/number}",
    "pulls_url": "https://api.github.com/repos/Tarocco/*****/pulls{/number}",
    "milestones_url": "https://api.github.com/repos/Tarocco/*****/milestones{/number}",
    "notifications_url": "https://api.github.com/repos/Tarocco/*****/notifications{?since,all,participating}",
    "labels_url": "https://api.github.com/repos/Tarocco/*****/labels{/name}",
    "releases_url": "https://api.github.com/repos/Tarocco/*****/releases{/id}",
    "deployments_url": "https://api.github.com/repos/Tarocco/*****/deployments",
    "created_at": *****,
    "updated_at": "2018-05-22T09:59:12Z",
    "pushed_at": *****,
    "git_url": "git://github.com/Tarocco/*****.git",
    "ssh_url": "[email protected]:Tarocco/*****.git",
    "clone_url": "https://github.com/Tarocco/*****.git",
    "svn_url": "https://github.com/Tarocco/*****",
    "homepage": null,
    "size": 0,
    "stargazers_count": 0,
    "watchers_count": 0,
    "language": "JavaScript",
    "has_issues": true,
    "has_projects": true,
    "has_downloads": true,
    "has_wiki": true,
    "has_pages": false,
    "forks_count": 0,
    "mirror_url": null,
    "archived": false,
    "open_issues_count": 0,
    "license": null,
    "forks": 0,
    "open_issues": 0,
    "watchers": 0,
    "default_branch": "master",
    "stargazers": 0,
    "master_branch": "master"
  },
  "pusher": {
    "name": "Tarocco",
    "email": "[email protected]"
  },
  "sender": {
    "login": "Tarocco",
    "id": *****,
    "avatar_url": "https://avatars0.githubusercontent.com/u/*****?v=4",
    "gravatar_id": "",
    "url": "https://api.github.com/users/Tarocco",
    "html_url": "https://github.com/Tarocco",
    "followers_url": "https://api.github.com/users/Tarocco/followers",
    "following_url": "https://api.github.com/users/Tarocco/following{/other_user}",
    "gists_url": "https://api.github.com/users/Tarocco/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/Tarocco/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/Tarocco/subscriptions",
    "organizations_url": "https://api.github.com/users/Tarocco/orgs",
    "repos_url": "https://api.github.com/users/Tarocco/repos",
    "events_url": "https://api.github.com/users/Tarocco/events{/privacy}",
    "received_events_url": "https://api.github.com/users/Tarocco/received_events",
    "type": "User",
    "site_admin": false
  }
}

Response:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>500 Internal Server Error</title>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error and was unable to complete your request.  Either the server is overloaded or there is an error in the application.</p>

On my server:

# cat /lib/systemd/system/github-webhook-handler.service

[Unit]
Description=GitHub Webhook Handler by razius

[Service]
Type=simple
Environment=REPOS_JSON_PATH=/opt/etc/github-webhook-handler-repos.json
ExecStart=/opt/bin/github-webhook-handler/index.py 9969

[Install]
WantedBy=multi-user.target

# systemctl status github-webhook-handler
● github-webhook-handler.service - GitHub Webhook Handler by razius
   Loaded: loaded (/lib/systemd/system/github-webhook-handler.service; disabled; vendor preset: enabled)
   Active: active (running) since Tue 2018-05-22 06:14:00 EDT; 1min 42s ago
 Main PID: 3261 (python)
    Tasks: 1 (limit: 4915)
   CGroup: /system.slice/github-webhook-handler.service
           └─3261 python /opt/bin/github-webhook-handler/index.py 9969

May 22 06:14:00 *** systemd[1]: Started GitHub Webhook Handler by razius.
May 22 06:14:00 *** index.py[3261]:  * Running on http://0.0.0.0:9969/ (Press CTRL+C to quit)
May 22 06:14:15 *** index.py[3261]: 192.30.252.36 - - [22/May/2018 06:14:15] "POST / HTTP/1.1" 500 -
May 22 06:15:40 *** index.py[3261]: 192.30.252.34 - - [22/May/2018 06:15:40] "POST / HTTP/1.1" 500 -

Is there a way to know more about what is going wrong?

403 forbidden error

Hi razius,

I tried using the handler. However it is giving 403 forbidden error.
do we have to provide crentials. If yes, Where and how?
Below is the repos.json -
{
"migunjan/gunjan_test": {
"path": "/home/gunjan_test",
"key": "SecretKey",
"action": [["git", "pull", "origin", "master"]]
}
}

RESPONSE -
Headers
Content-Length: 234
Content-Type: text/html
Date: Tue, 07 Mar 2017 11:28:37 GMT
Server: Werkzeug/0.11.15 Python/2.6.6
Body

<title>403 Forbidden</title>

Forbidden

You don't have the permission to access the requested resource. It is either read-protected or not readable by the server.

Please help

Testing?

How can I know if this is functioning? I've tried various things, but can't figure it out.