feat(webhook): Add Gitea/Forgejo webhook support (rebased from #66895) - #89427
Open
Leowr997 wants to merge 3 commits into
Open
feat(webhook): Add Gitea/Forgejo webhook support (rebased from #66895)#89427Leowr997 wants to merge 3 commits into
Leowr997 wants to merge 3 commits into
Conversation
added 3 commits
August 18, 2026 22:57
Gitea sends X-Gitea-Signature header with HMAC-SHA256 hex digest. This patch adds support for validating Gitea webhook signatures. Fixes: Gitea webhooks fail with 'Invalid signature' error Related-to: https://github.com/NousResearch/hermes-agent
- Add _gitea_signature() helper function - Add test_validate_gitea_signature_valid - Add test_validate_gitea_signature_invalid - Add test_validate_gitea_signature_wrong_body_rejected - Add X-Gitea-Signature to non-ASCII header rejection test - Add comment explaining X-Hub-Signature-256 fallback for modern Gitea All 30 signature validation tests pass. Addresses PR review feedback on NousResearch#66895
This PR now provides full Gitea and Forgejo webhook support: **Signature Validation:** - X-Gitea-Signature (HMAC-SHA256 hex, no prefix) - X-Forgejo-Signature (same format as Gitea) **Event Type Extraction:** - X-Gitea-Event header recognition - X-Forgejo-Event header recognition **Tests Added:** - test_validate_gitea_signature_valid/invalid/wrong_body - test_validate_forgejo_signature_valid/invalid/wrong_body - test_event_filter_accepts_gitea_event/rejects_non_matching - test_event_filter_accepts_forgejo_event/rejects_non_matching - X-Gitea-Signature and X-Forgejo-Signature in non-ASCII test **Test Results:** - 33 signature validation tests pass - 8 event filter tests pass This supersedes NousResearch#63108 by providing complete implementation with matching tests (no test/code gaps). Closes NousResearch#66893
alt-glitch
added
type/feature
Contributor
Clean provider addition: raw-hex HMAC verification for — reviewer-b (automated review) No blocking issues found. |
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a rebased copy of #66895 (feat(webhook): Add Gitea webhook signature validation support) by MISAKIGA — all code and test work credit goes to them. We simply want this fix merged, as the original PR has been stalled for a month.
Why this PR exists
MISAKIGA:fix/add-gitea-webhook-signature-supportat715f139cb4mergeable_state: dirty(conflicts withmain), no activity since 2026-07-18The author's original commits are cherry-picked verbatim onto current
main(authorship preserved — all three commits are
MISAKIGA's), withconflicts resolved:
715f139cb4feat(webhook): Add complete Gitea/Forgejo webhook supportac97a43957test(webhook): Add Gitea signature validation testsd5a2f46493feat(webhook): Add Gitea webhook signature validation supportWhat it does
Adds full Gitea/Forgejo webhook support to
gateway/platforms/webhook.py(+24 lines):X-Gitea-Event/X-Forgejo-EventheadersX-Gitea-Signature/X-Forgejo-Signature(bare-hex HMAC-SHA256, the format Gitea/Forgejo actually send)Plus regression tests (+226 lines in
tests/gateway/test_webhook_adapter.py).Verification
tests/gateway/test_webhook_adapter.pyon this branch (baseline on pristinemain: 34 tests pass)Request to maintainers
Either merge this, or — if you'd prefer the original — please ask @MISAKIGA to rebase #66895. We're happy to close this the moment the original lands; we're not trying to displace the author's credit, just get a month-old working fix merged.
Related: #83723, #66895, #18041, #66893