fix(server/auth/webhook): update GitHub webhook events list and library version (argoproj#14389)

Signed-off-by: Malthe Poulsen <[email protected]>

Author: malpou

go.mod

@@ -26,6 +26,7 @@ require (
 	github.com/go-git/go-git/v5 v5.16.0
 	github.com/go-jose/go-jose/v3 v3.0.4
 	github.com/go-openapi/jsonreference v0.21.0
+	github.com/go-playground/webhooks/v6 v6.4.0
 	github.com/go-sql-driver/mysql v1.9.2
 	github.com/gogo/protobuf v1.3.2
 	github.com/golang/protobuf v1.5.4

go.sum

@@ -326,6 +326,8 @@ github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
 github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-playground/webhooks/v6 v6.4.0 h1:KLa6y7bD19N48rxJDHM0DpE3T4grV7GxMy1b/aHMWPY=
+github.com/go-playground/webhooks/v6 v6.4.0/go.mod h1:5lBxopx+cAJiBI4+kyRbuHrEi+hYRDdRHuRR4Ya5Ums=
 github.com/go-sql-driver/mysql v1.9.2 h1:4cNKDYQ1I84SXslGddlsrMhc8k4LeDVj6Ad6WRjiHuU=
 github.com/go-sql-driver/mysql v1.9.2/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=

server/auth/webhook/github.go

@@ -3,7 +3,7 @@ package webhook
 import (
 	"net/http"
 
-	"gopkg.in/go-playground/webhooks.v5/github"
+	"github.com/go-playground/webhooks/v6/github"
 )
 
 func githubMatch(secret string, r *http.Request) bool {
@@ -14,12 +14,16 @@ func githubMatch(secret string, r *http.Request) bool {
 	_, err = hook.Parse(r,
 		github.CheckRunEvent,
 		github.CheckSuiteEvent,
+		github.CodeScanningAlertEvent,
 		github.CommitCommentEvent,
 		github.CreateEvent,
 		github.DeleteEvent,
+		github.DependabotAlertEvent,
+		github.DeployKeyEvent,
 		github.DeploymentEvent,
 		github.DeploymentStatusEvent,
 		github.ForkEvent,
+		github.GitHubAppAuthorizationEvent,
 		github.GollumEvent,
 		github.InstallationEvent,
 		github.InstallationRepositoriesEvent,
@@ -52,6 +56,9 @@ func githubMatch(secret string, r *http.Request) bool {
 		github.TeamEvent,
 		github.TeamAddEvent,
 		github.WatchEvent,
+		github.WorkflowDispatchEvent,
+		github.WorkflowJobEvent,
+		github.WorkflowRunEvent,
 	)
 	return err == nil
 }

server/auth/webhook/interceptor_test.go

@@ -59,8 +59,8 @@ func TestInterceptor(t *testing.T) {
 	})
 	t.Run("Github", func(t *testing.T) {
 		r, _ := intercept("POST", "/api/v1/events/my-ns/my-d", map[string]string{
-			"X-Github-Event":  "push",
-			"X-Hub-Signature": "00000ba880174336fbe22d4723a67ba5c4c356ec9c696",
+			"X-Github-Event":      "push",
+			"X-Hub-Signature-256": "sha256=926ceeb8dcd67d5979fd7d726e3905af6d220f7fd6b2d8cce946906f7cf35963",
 		})
 		assert.Equal(t, []string{"Bearer my-github-token"}, r.Header["Authorization"])
 	})

test/e2e/argo_server_test.go

@@ -182,7 +182,7 @@ spec:
 			s.e().
 				POST("/api/v1/events/argo/").
 				WithHeader("X-Github-Event", "push").
-				WithHeader("X-Hub-Signature", "sha1=c09e61386e81c2669e015049350500448148205c").
+				WithHeader("X-Hub-Signature-256", "sha256=dd6f6b41f6d0cb9523d6459032e164e220853b683a5e87892145b0eb0b84e0cd").
 				WithBytes(data).
 				Expect().
 				Status(200)