🔍 PR Lint Feedback

Note: This automated check helps ensure your PR follows our contribution guidelines.

⚠️ Items that need attention:

🤖 AI attribution

The following commits lack an explicit AI attribution footer:

• e492f7b fix: Enforce webhook signature for Forgejo

If no AI assistance was used for a commit, you can ignore this warning.
Otherwise add an Assisted-by: or Co-authored-by: footer referencing the AI used.

ℹ️ Next Steps

• Review and address the items above
• Push new commits to update this PR
• This comment will be automatically updated when issues are resolved

_{🤖 This feedback was generated automatically by the PR CI system}

Summary of Changes

Hello @chmouel, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the security posture of Gitea and Forgejo webhook integrations by introducing robust signature validation. By requiring and verifying cryptographic signatures on incoming webhook payloads, the system can now confidently ascertain that requests originate from trusted sources and have not been tampered with. This change hardens the application against potential spoofing attacks and ensures data integrity, backed by extensive test cases.

Highlights

• Enhanced Webhook Security: Implemented mandatory signature validation for Gitea and Forgejo webhooks to ensure the authenticity and integrity of incoming requests.
• HMAC-SHA256 Validation: Utilizes HMAC-SHA256 hashing to verify 'X-Forgejo-Signature' and 'X-Gitea-Signature' headers against a configured webhook secret.
• Comprehensive Test Coverage: Added new unit and integration tests to thoroughly validate the signature checking logic under various scenarios, including valid, invalid, and missing signatures/secrets.
• Non-Breaking Change: This security enhancement is designed to be non-breaking, as previous Gitea usage was primarily for local testing without strict validation.

/compliance --pr_compliance.enable_ticket_labels=true

PR Compliance Guide 🔍

(Compliance updated until commit f79d333)

Below is a summary of compliance checks for this PR:

signature := event.Request.Header.Get(ForgejoSignatureHeader)
if signature == "" {
	signature = event.Request.Header.Get(GiteaSignatureHeader)
}
if signature == "" {
	return fmt.Errorf("no signature has been detected, for security reason we are not allowing webhooks without a secret")
}

secret := event.Provider.WebhookSecret
if secret == "" {
	return fmt.Errorf("no webhook secret has been set, in repository CR or secret")
}

return validateSignature(signature, event.Request.Payload, []byte(secret))

signature := event.Request.Header.Get(ForgejoSignatureHeader)
if signature == "" {
	signature = event.Request.Header.Get(GiteaSignatureHeader)
}
if signature == "" {
	return fmt.Errorf("no signature has been detected, for security reason we are not allowing webhooks without a secret")
}

secret := event.Provider.WebhookSecret
if secret == "" {
	return fmt.Errorf("no webhook secret has been set, in repository CR or secret")
}

return validateSignature(signature, event.Request.Payload, []byte(secret))

Previous compliance checks

webhookSecret, _ := os.LookupEnv("TEST_EL_WEBHOOK_SECRET")
if err := secret.Create(ctx, topts.ParamsRun, map[string]string{"secret": webhookSecret}, ns, webhookSecretName); err != nil {
	return err
}

func (v *Provider) Validate(_ context.Context, _ *params.Run, event *info.Event) error {
	signature := event.Request.Header.Get(ForgejoSignatureHeader)
	if signature == "" {
		signature = event.Request.Header.Get(GiteaSignatureHeader)
	}
	if signature == "" {
		return fmt.Errorf("no signature has been detected, for security reason we are not allowing webhooks without a secret")
	}

	secret := event.Provider.WebhookSecret
	if secret == "" {
		return fmt.Errorf("no webhook secret has been set, in repository CR or secret")
	}

	return validateSignature(signature, event.Request.Payload, []byte(secret))
}

func validateSignature(signature string, payload, secret []byte) error {
	signatureBytes, err := hex.DecodeString(signature)
	if err != nil {
		return fmt.Errorf("gitea/forgejo webhook signature is not valid hex: %w", err)


 ... (clipped 9 lines)

❌ PR-Agent failed to apply 'global' repo settings

The configuration file needs to be a valid TOML, please fix it.

Error message:
cannot access local variable 'file_data' where it is not associated with a value

[github_app]
pr_commands = [ "/review" ]

[pr_reviewer]
enable_review_labels_security = true
enable_chat_in_code_suggestions=false
enable_chat_in_code_suggestions = false
enable_summary=false
enable_help_text=false

[pr_description]
publish_description_as_comment = true

[pr_code_suggestions]
commitable_code_suggestions = true

[pr_test]
num_tests = 0

/retest

/test go-testing

PR-Agent: could not fine a component named go-testing in a supported language in this PR.

/retest

/retest