Repository navigation
feat(webhooks): add objgit-webhook-set SSH command - #19
Merged
Merged
Conversation
Before this change, the only way to change a repository's webhook was to write its settings object into the bucket by hand. The new objgit-webhook-set SSH command sets the URL with -url and rotates the signing secret with -rotate-secret. Flags that are left out keep their current values. A secret is generated when none exists, and the stored settings (secret included) are printed. The URL goes through the same validation as delivery before anything is written. The default AllowAnonymous authorizer now grants Admin to every client, as a temporary measure until an ACL-backed authorizer exists. Any client that can reach the HTTP or SSH listener can therefore read every webhook secret and change every webhook target. Assisted-by: Claude Opus 5.5 via Claude Code Signed-off-by: Xe Iaso <xe@tigrisdata.com>
rbarabas
approved these changes
Sep 24, 2026
Xe
pushed a commit
that referenced
this pull request
Sep 24, 2026
# [1.12.0](v1.11.0...v1.12.0) (2026-09-24) ### Features * **webhooks:** add objgit-webhook-set SSH command ([#19](#19)) ([6d1f575](6d1f575)) Signed-off-by: Tigris Data <social@tigrisdata.com>
Xe
pushed a commit
that referenced
this pull request
Sep 24, 2026
# [1.12.0](v1.11.0...v1.12.0) (2026-09-24) ### Features * **webhooks:** add objgit-webhook-set SSH command ([#19](#19)) ([6d1f575](6d1f575)) Signed-off-by: Tigris Data <social@tigrisdata.com>
|
🎉 This PR is included in version 1.12.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
objgit-webhook-set org/repo [-url URL] [-rotate-secret]SSH command. It changes a repository's webhook settings and prints them, secret included.Adminto every client in the defaultAllowAnonymousauthorizer.Details
Flags that are left out keep their current values. A secret is generated when none exists, and the URL is validated before anything is written. Security: with this change, any client that can reach the HTTP or SSH listener can read every webhook secret and change every webhook target. Do not deploy it where untrusted clients can reach it.
Test plan
go build ./...npm run format(goimports and prettier checked on the changed files)go test ./...passes, includingTestSSHWebhookSet(12 cases over a realsshclient) andTestWriteSettings