Jörg Thalheim f2cbf14f7e webhooks: implement authentication for GitHub and Gitea ...

- Add HMAC-SHA256 signature verification for webhooks
- Support multiple secrets for rotation
- Add security logging for authentication events
- Maintain backward compatibility (auth optional during migration)
- Add comprehensive test coverage

Without authentication, anyone could trigger job evaluations by sending
POST requests to webhook endpoints. This could lead to resource exhaustion
through repeated requests or manipulation of build scheduling. While not
a data breach risk, it allows unauthorized control over CI/CD operations.

2025-09-07 22:48:40 -04:00

6.7 KiB

Raw Blame History

View Raw