gitlab integration to allow outsourcing hook creation
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 624
Description
### Problem Statement
Currently the gitlab integration wants to manage hooks by itself, this requires that the user behind the integration token is `Maintainer` on the gitlab side projects. This turns sentry into an attack surface for the gitlab project(s). It'd be grand if the integration could get by with `Guest` permissions only, which AFAICS is the case, except for hook management.
### Solution Brainstorm
Instead of managing hooks directly the hook secret along with the hook URL could be shown on the configuration page of the integration, allowing external actors to set up the webhook on behalf of sentry (e.g. another service that manages webhook - that is how we usually manage webhooks at KDE).
Code-wise this probably shouldn't be too complicated since `build_repository_config` needs to only handle the error differently: throw up a warning in the UI "yo, hooks failed to set up, either do it manually or fix permissions" but still proceed with an empty `hook_id`.
Contributor guide
Assessment
This issue has not been assessed yet.