Merge pull request #933 from snyk/feat/update-hook-rules

fix: add github and azure-repos filter rules for webhook event upgrades
snyk · Feb 21, 2025 · a26247f · a26247f
2 parents 309c97f + e5ef101
commit a26247f
Show file tree

Hide file tree

Showing 10 changed files with 462 additions and 0 deletions.
diff --git a/client-templates/azure-repos/accept.json.sample b/client-templates/azure-repos/accept.json.sample
@@ -414,6 +414,16 @@
         "scheme": "basic",
         "token": "${BROKER_CLIENT_VALIDATION_BASIC_AUTH}"
       }
+    },
+    {
+      "//": "get webhook",
+      "method": "GET",
+      "path": "/_apis/hooks/subscriptions/:subscriptionId",
+      "origin": "https://${AZURE_REPOS_HOST}/${AZURE_REPOS_ORG}",
+      "auth": {
+        "scheme": "basic",
+        "token": "${BROKER_CLIENT_VALIDATION_BASIC_AUTH}"
+      }
     }
   ]
 }
diff --git a/client-templates/github-com/accept.json.sample b/client-templates/github-com/accept.json.sample
@@ -2142,6 +2142,12 @@
       "method": "PATCH",
       "path": "/repos/:name/:repo/hooks/:id/config",
       "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
+    },
+    {
+      "//": "allow webhooks to be updated, to allow for event upgrades",
+      "method": "PATCH",
+      "path": "/repos/:name/:repo/hooks/:id",
+      "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
     }
   ]
 }
diff --git a/client-templates/github-enterprise/accept.json.sample b/client-templates/github-enterprise/accept.json.sample
@@ -1422,6 +1422,12 @@
       "method": "PATCH",
       "path": "/repos/:name/:repo/hooks/:id/config",
       "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
+    },
+    {
+      "//": "allow webhooks to be updated, to allow for event upgrades",
+      "method": "PATCH",
+      "path": "/repos/:name/:repo/hooks/:id",
+      "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
     }
   ]
 }
diff --git a/client-templates/github-server-app/accept.json.sample b/client-templates/github-server-app/accept.json.sample
@@ -1422,6 +1422,12 @@
       "method": "PATCH",
       "path": "/repos/:name/:repo/hooks/:id/config",
       "origin": "https://${GITHUB_API}"
+    },
+    {
+      "//": "allow webhooks to be updated, to allow for event upgrades",
+      "method": "PATCH",
+      "path": "/repos/:name/:repo/hooks/:id",
+      "origin": "https://${GITHUB_API}"
     }
   ]
 }
diff --git a/defaultFilters/azure-repos.json b/defaultFilters/azure-repos.json
@@ -422,6 +422,16 @@
           "scheme": "basic",
           "token": "${BROKER_CLIENT_VALIDATION_BASIC_AUTH}"
         }
+      },
+      {
+        "//": "get webhook",
+        "method": "GET",
+        "path": "/_apis/hooks/subscriptions/:subscriptionId",
+        "origin": "https://${AZURE_REPOS_HOST}/${AZURE_REPOS_ORG}",
+        "auth": {
+          "scheme": "basic",
+          "token": "${BROKER_CLIENT_VALIDATION_BASIC_AUTH}"
+        }
       }
     ]
   }
diff --git a/defaultFilters/github-enterprise.json b/defaultFilters/github-enterprise.json
@@ -1422,6 +1422,12 @@
         "method": "PATCH",
         "path": "/repos/:name/:repo/hooks/:id/config",
         "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
+      },
+      {
+        "//": "allow webhooks to be updated, to allow for event upgrades",
+        "method": "PATCH",
+        "path": "/repos/:name/:repo/hooks/:id",
+        "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
       }
     ]
   }
diff --git a/defaultFilters/github-server-app.json b/defaultFilters/github-server-app.json
@@ -2033,5 +2033,15 @@
           "token": "${GHA_ACCESS_TOKEN}"
         }
       },
+      {
+        "//": "allow webhooks to be updated, to allow for event upgrades",
+        "method": "PATCH",
+        "path": "/repos/:name/:repo/hooks/:id",
+        "origin": "https://${GITHUB_API}",
+        "auth": {
+          "scheme": "bearer",
+          "token": "${GHA_ACCESS_TOKEN}"
+        }
+      }
     ]
   }
diff --git a/defaultFilters/github.json b/defaultFilters/github.json
@@ -2140,6 +2140,12 @@
         "method": "PATCH",
         "path": "/repos/:name/:repo/hooks/:id/config",
         "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
+      },
+      {
+        "//": "allow webhooks to be updated, to allow for event upgrades",
+        "method": "PATCH",
+        "path": "/repos/:name/:repo/hooks/:id",
+        "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
       }
     ]
   }
diff --git a/test/fixtures/accept/github.json b/test/fixtures/accept/github.json
@@ -50,6 +50,12 @@
       "method": "PATCH",
       "path": "/repos/:name/:repo/hooks/:id/config",
       "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
+    },
+    {
+      "//": "allow webhooks to be updated, to allow for event upgrades",
+      "method": "PATCH",
+      "path": "/repos/:name/:repo/hooks/:id",
+      "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
     }
   ]
 }