Currently, any 400 error that occurs will be swallowed by
`SrhtService.post()` [1] - the caller must use a validation object to
become aware of an error.
This commit adds such error handling by means of a validation object to
the build submission webhook.
[1]: https://git.sr.ht/~sircmpwn/hub.sr.ht/tree/f37b9e6e/item/hubsrht/services.py#L56-60
There is currently a mismatch, causing for example project creation via
the web interface to fail, because the validation code is using the enum
keys, which are lowercase, but everything else uses uppercase.
Simply use uppercase everywhere, like already the case in other
services.
When pushing a tag, the webhooks are invoked twice: once for the the
commit and once for the tag. Avoid inserting the same comment multiple
times. This also fixes the multiple comments issue when a git repository
is associated with more than one project.
This requires the new graphql method to get specific tickets by their
scoped ID on a given tracker.
Signed-off-by: Robin Jarry <robin@jarry.cc>
The raw body of comments is included in email notifications. HTML makes
ugly plain text messages.
Use markdown for generated tracker comments which can be used in plain
text emails as-is.
Fixes: https://todo.sr.ht/~sircmpwn/hub.sr.ht/77
Fixes: be5d50d8d8 ("webhooks: update todo tickets with git commits")
Signed-off-by: Robin Jarry <robin@jarry.cc>
Allow referencing tracker tickets in git commit messages via specific
trailer words:
Fixes: <ticket url>
Implements: <ticket url>
References: <ticket url>
These must follow standard git trailer syntax. The trailers are
extracted from commit messages with the function added in previous
commit. The ticket url must point to a valid ticket.
A comment will be inserted in the ticket with a back reference to the
git commit and its original author. The comment will be made by the user
who pushed the commit. E.g.:
~arkanoid REPORTED -> FIXED 9 seconds ago
John Doe referenced this ticket in commit b4dc4c40.
Open tickets referenced by a Fixes trailer will be resolved with the
FIXED resolution.
Open tickets referenced by an Implements trailer will be resolved with
the IMPLEMENTED resolution.
Caveats:
* Only the 25 most recent commit messages will be considered when
pushing long series. This should be a fairly sane limitation.
* If the user pushing commits does not have triage/comment permissions
on the bug tracker, nothing will happen.
* Invalid/non-existent ticket urls are ignored.
* When a git repository is part of more than one project, the webhook
will run once per project and update the same ticket(s) once per
project as well.
* If an already resolved ticket is referenced by a Fixes or Implements
trailer, only a comment will be added.
Link: https://git-scm.com/docs/git-interpret-trailers
Implements: https://todo.sr.ht/~sircmpwn/hub.sr.ht/55
Signed-off-by: Robin Jarry <robin@jarry.cc>
This sounds like an XSS vulnerability, but really the only thing you can
exploit prior to this is silly things like putting an <h1> into commit
messages. These details were already sanitized at a later part of the
code.
Conrad Hoffmann