Merge pull request #7028 from pawelmitka/webhook_default_secret

feat(plugin-scaffolder-backend): Default GitHub Webhook Action secret

.changeset/four-bobcats-confess.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+GitHubWebhook Action can be created with a default webhook secret. This allows getting secret from environment variable as an alternative to get it from context.

plugins/scaffolder-backend/api-report.md

@@ -120,6 +120,7 @@ export function createGithubActionsDispatchAction(options: {
 // @public (undocumented)
 export function createGithubWebhookAction(options: {
   integrations: ScmIntegrationRegistry;
+  defaultWebhookSecret?: string;
 }): TemplateAction<any>;
 
 // Warning: (ae-missing-release-tag) "createPublishAzureAction" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)

plugins/scaffolder-backend/src/scaffolder/actions/builtin/github/githubWebhook.test.ts

@@ -33,13 +33,16 @@ describe('github:repository:webhook:create', () => {
   });
 
   const integrations = ScmIntegrations.fromConfig(config);
-  const action = createGithubWebhookAction({ integrations });
+  const defaultWebhookSecret = 'aafdfdivierernfdk23f';
+  const action = createGithubWebhookAction({
+    integrations,
+    defaultWebhookSecret,
+  });
 
   const mockContext = {
     input: {
       repoUrl: 'github.com?repo=repo&owner=owner',
       webhookUrl: 'https://example.com/payload',
-      webhookSecret: 'aafdfdivierernfdk23f',
     },
     workspacePath: 'lol',
     logger: getVoidLogger(),
@@ -57,12 +60,33 @@ describe('github:repository:webhook:create', () => {
   it('should call the githubApi for creating repository Webhook', async () => {
     const repoUrl = 'github.com?repo=repo&owner=owner';
     const webhookUrl = 'https://example.com/payload';
-    const webhookSecret = 'aafdfdivierernfdk23f';
     const ctx = Object.assign({}, mockContext, {
-      input: { repoUrl, webhookUrl, webhookSecret },
+      input: { repoUrl, webhookUrl },
     });
     await action.handler(ctx);
 
+    expect(mockGithubClient.repos.createWebhook).toHaveBeenCalledWith({
+      owner: 'owner',
+      repo: 'repo',
+      events: ['push'],
+      active: true,
+      config: {
+        url: webhookUrl,
+        content_type: 'form',
+        secret: defaultWebhookSecret,
+        insecure_ssl: '0',
+      },
+    });
+
+    const webhookSecret = 'yet_another_secret';
+    await action.handler({
+      ...mockContext,
+      input: {
+        ...mockContext.input,
+        webhookSecret,
+      },
+    });
+
     expect(mockGithubClient.repos.createWebhook).toHaveBeenCalledWith({
       owner: 'owner',
       repo: 'repo',
@@ -92,7 +116,7 @@ describe('github:repository:webhook:create', () => {
       config: {
         url: webhookUrl,
         content_type: 'form',
-        secret: webhookSecret,
+        secret: defaultWebhookSecret,
         insecure_ssl: '0',
       },
     });
@@ -113,7 +137,7 @@ describe('github:repository:webhook:create', () => {
       config: {
         url: webhookUrl,
         content_type: 'json',
-        secret: webhookSecret,
+        secret: defaultWebhookSecret,
         insecure_ssl: '0',
       },
     });
@@ -134,7 +158,7 @@ describe('github:repository:webhook:create', () => {
       config: {
         url: webhookUrl,
         content_type: 'form',
-        secret: webhookSecret,
+        secret: defaultWebhookSecret,
         insecure_ssl: '1',
       },
     });
@@ -155,7 +179,7 @@ describe('github:repository:webhook:create', () => {
       config: {
         url: webhookUrl,
         content_type: 'form',
-        secret: webhookSecret,
+        secret: defaultWebhookSecret,
         insecure_ssl: '1',
       },
     });
@@ -176,7 +200,7 @@ describe('github:repository:webhook:create', () => {
       config: {
         url: webhookUrl,
         content_type: 'form',
-        secret: webhookSecret,
+        secret: defaultWebhookSecret,
         insecure_ssl: '0',
       },
     });

plugins/scaffolder-backend/src/scaffolder/actions/builtin/github/githubWebhook.ts

@@ -21,8 +21,9 @@ type ContentType = 'form' | 'json';
 
 export function createGithubWebhookAction(options: {
   integrations: ScmIntegrationRegistry;
+  defaultWebhookSecret?: string;
 }) {
-  const { integrations } = options;
+  const { integrations, defaultWebhookSecret } = options;
   const octokitProvider = new OctokitProvider(integrations);
 
   return createTemplateAction<{
@@ -53,7 +54,8 @@ export function createGithubWebhookAction(options: {
           },
           webhookSecret: {
             title: 'Webhook Secret',
-            description: 'Webhook secret value',
+            description:
+              'Webhook secret value. The default can be provided internally in action creation',
             type: 'string',
           },
           events: {
@@ -88,7 +90,7 @@ export function createGithubWebhookAction(options: {
       const {
         repoUrl,
         webhookUrl,
-        webhookSecret,
+        webhookSecret = defaultWebhookSecret,
         events = ['push'],
         active = true,
         contentType = 'form',