Skip to content

Integrate with Netlify's post-deploy notifications

Jamie Tanna requested to merge feature/netlify into develop

I've found that integration with GitLab's post-deploy webhooks has been a bit disappointing recently, as uploads to Netlify have "failed" (therefore the pipeline has failed, and post-deploy hasn't triggered) but the upload then succeeds later.

Therefore, we want to replace it with an expected request coming in from Netlify.

Netlify can provide a JWS, with a shared secret, that contains a hash of the request's body, allowing further proof that only the request is valid.

This requires us to hook in Nimbus to validate the JWS, and some custom logic to validate that the JWS is well-formed, and the sha256 hash of the body is correct.

  • We can follow the instructions from 0 to allow us to read the request body in both the Filter, and through @RequestBody.
  • We can also remove Spring Security, as this is no longer applied through it
  • Remove the existing references to anything GitLab related, with respect to post-deploy configuration / validation
  • MultiReadHttpServletRequest and ServletInputStreamReader make it easier for unit testing
  • We need to provide a sufficient length of netlify.shared-secret.value, as the MACVerifier requires a certain length

Closes #107 (closed).

Merge request reports