-
-
Notifications
You must be signed in to change notification settings - Fork 7
Conversation
@@ -15,4 +15,8 @@ def verify_signature(payload_body) | |||
signature = 'sha1=' + OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha1'), settings.github_secret, payload_body) | |||
throw(:halt, [500, "Signatures didn't match!\n"]) unless Rack::Utils.secure_compare(signature, request.env['HTTP_X_HUB_SIGNATURE']) | |||
end | |||
|
|||
def payload |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure about this. It's only very slightly more convenient than using env['parsed_body'] and there might be a better way. I'm going to see what https://github.com/aars/rack-bodyparser#patch-rackrequest is all about.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like this. Even if it's not that much shorter, it's much clearer naming.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Cool. I did look at https://github.com/aars/rack-bodyparser#patch-rackrequest, but it didn't really seem much of an improvement. Instead of env['parsed_body']
you could use eg request.payload
.
lib/parsers/webhook_json_parser.rb
Outdated
return false unless @data['repository'].key? 'html_url' | ||
return false unless @data['repository']['html_url'] =~ %r{github\.com} | ||
true | ||
@env.key?('HTTP_X_GITHUB_EVENT') |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is the big win. It's so much nicer now that we have easy access to the headers.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Much safer too, since that's the public API. Relying on internal implementation details always seems so hacky. (not to mention that it would fail on self-hosted GitHub appliances.)
spec/unit/puppet_webhook_spec.rb
Outdated
@@ -6,4 +6,12 @@ | |||
expect(last_response).to be_ok | |||
expect(last_response.body).to eq('{"status":"success","message":"running"}') | |||
end | |||
|
|||
it '/echo returns parsed payload' do |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Testing the parser via a route might be easier than testing the parser class directly?
lib/routes/default.rb
Outdated
@@ -12,6 +12,10 @@ def self.registered(puppet_webhook) | |||
puppet_webhook.get '/heartbeat' do | |||
return 200, { status: :success, message: 'running' }.to_json | |||
end | |||
|
|||
puppet_webhook.post '/echo' do |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure that we should have this here. The function that this endpoint is providing can already be found via Ruby development tools, the puppet_webhook
log, and the spec tests.
For reference. Here is my idea about how we could update the parser testing. alexjfisher@2600e1c |
Test coverage is down quite a bit by stubbing detect_vcs. Whatever approach we take, we should probably get it back to where it was before merging anything. I think I want to at least include the attribute accessor changes from alexjfisher@2600e1c#diff-8a56f49e6638cadc28a93357766ba2a7 P.S. Since I opened the PR, github won't let me review it (which kinda sucks). I must also remember to edit the commit message on my first commit. It's still marked WIP. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
imo, reducing coverage by removing unhelpful tests is still a net positive. I'm digging this.
@binford2k I was fine with removing the /echo endpoint, but how should we test detect_vcs ? |
a41e1a0
to
081c0a2
Compare
Added slightly tweaked version of ekohl@5afb937 and rebased. |
spec/spec_helper.rb
Outdated
@@ -25,6 +25,10 @@ module Methods | |||
def read_fixture(name) | |||
File.read(File.join(File.expand_path('..', __FILE__), 'fixtures', name)) | |||
end | |||
|
|||
def read_json_fixture(name) | |||
JSON.load(read_fixture(name)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Guess I should have used JSON.parse
instead.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yep. Just spotted that. Commit amended and repushed.
081c0a2
to
46c5683
Compare
@bastelfreak Odd the codacy-bot can't delete its own comments. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are those codacy comments really adding something or can we disable them? You can always view the details on the website.
This was unreachable since we raise an error if we don't detect one of the supported VCSs.
@ekohl Personally, I quite like them. I can see how they'd be useful when we have new contributors. |
@@ -87,8 +87,6 @@ def deleted? | |||
@data['push']['changes'][0]['closed'] | |||
when 'tfs' | |||
@data['resource']['refUpdates'][0]['newObjectId'] == '0000000000000000000000000000000000000000' | |||
else | |||
false |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why would you remove this? I actually like being able to rely on a boolean.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It was unreachable. We already raise an exception if we can't detect a VCS. I can put it back though.
I think I should set something for 'COVERAGE DECREASE THRESHOLD FOR FAILURE' in coveralls though. We haven't really reduced our coverage, but we have removed code and that's given us a smaller percentage. |
No description provided.