getsentry / getsentry/sentry

gitlab integration to allow outsourcing hook creation

Open
#36,120 8 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
1d 5h
Merged PRs (30d)
624

Description

### Problem Statement

Currently the gitlab integration wants to manage hooks by itself, this requires that the user behind the integration token is `Maintainer` on the gitlab side projects. This turns sentry into an attack surface for the gitlab project(s). It'd be grand if the integration could get by with `Guest` permissions only, which AFAICS is the case, except for hook management.

### Solution Brainstorm

Instead of managing hooks directly the hook secret along with the hook URL could be shown on the configuration page of the integration, allowing external actors to set up the webhook on behalf of sentry (e.g. another service that manages webhook - that is how we usually manage webhooks at KDE).

Code-wise this probably shouldn't be too complicated since `build_repository_config` needs to only handle the error differently: throw up a warning in the UI "yo, hooks failed to set up, either do it manually or fix permissions" but still proceed with an empty `hook_id`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.