Repository navigation
Prepare release 4.14.0 - #1409
Merged
Merged
Conversation
…ty (#1396) * Add allowlist for post-creation script repositories to enhance security * Update changelog
Fix VIT0089530
Fix VIT0089531
Fix VIT0089533
Fix VIT0089535
Fix VIT0089540
* Trigger secret won't use a default value * Add validation for cross-project pull requests in webhook handler * Add test for rejecting cross-project pull requests in webhook handler * Update Dockerfile to use specific image digest for ubi-micro and adjust user permissions * Remove trigger secret from logs. * Enhance validation and escaping in webhook handler and template processing - Introduced regex patterns for validating repository names and branch names. - Updated event validation to reject unsafe characters and ensure proper field lengths. - Refactored template parsing to safely encode user-controlled values, preventing JSON injection. - Added comprehensive tests for event validation and template rendering. * Add validation for jenkinsfile_path parameter in webhook handler * Validate target project in webhook handler and update test payloads for project key consistency * Fix as the cluster assign an user and provides conflicts * Add redirect handling to secure HTTP client to prevent token leakage * Enhance branch protection checks to be case-insensitive in webhook handler * Use constant-time comparison for trigger_secret in webhook handler to enhance security * Add IP range validation for webhook requests * Enhance security * Implement HMAC secret generation and verification for Bitbucket webhook payloads * Add WEBHOOK_HMAC_SECRET_B64 parameter and reference in webhook proxy configuration * Add WEBHOOK_HMAC_SECRET to configuration and implement HMAC signing for webhook requests * Add webhook HMAC secret handling to Jenkins setup scripts * Add HMAC secret handling to Jenkins test scripts and update dependencies * Add script to migrate Bitbucket webhooks to HMAC secret handling * Add script to migrate webhook-proxy secrets with HMAC support * Add migration scripts for webhook proxy and Jira properties - Introduced common.sh for shared functions used across migration scripts. - Created jira-property-client.sh to manage Jira project properties via REST API. - Developed migrate-bitbucket-webhook-hmac.sh to migrate Bitbucket webhooks, removing trigger_secret and adding HMAC secret. - Implemented migrate-jira-webhook-properties.sh to update Jira properties for WEBHOOK_PROXY.SECRET and WEBHOOK_PROXY.URL. - Added migrate-openshift-webhook-secret.sh to migrate OpenShift secrets for webhook-hmac-secret. - Created migrate-webhooks.sh to orchestrate the migration process for multiple projects, integrating all previous scripts. * Receive Hmac key and pass it to tailor on cd namespace creation * Receive b64-encoded hmac secret * Pass webhook allowed IP ranges to tailor * Rename tailor template parameters * Remove UUID validation for trigger secret and enforce non-empty check * Revert the removal of the CD_PASSWORD env variable * Set the allowed IP ranges and fix the Hmac secret * Fix webhook migration scripts to work in windows and avoid writing the secrets to the output * Migrate provapp data * Omit the output of curl to hide secret * Rollout the webhook proxy and the provapp after migration * Ignore errors when rolling out apps * Add the env var WEBHOOK_HMAC_SECRET to the webhook-proxy --------- Co-authored-by: Jorge Romero <jorge.romero.ext@boehringer-ingelheim.com>
Enhance secret management and deployment configuration by introducing automated property cleanup, adding ProvApp secrets, mapping secret values as environment variables, and updating deployment resources. Also improve migration script robustness by fixing escaping issues, ensuring failure tolerance, and automatically restarting webhook proxies when changes are applied.
BraisVQ
marked this pull request as ready for review
October 13, 2026 13:30
hrcornejo
approved these changes
Oct 13, 2026
valituguran
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.