Webhook security

[siepkes]

Describe the issue

I can't find information on how to enable webhook authentication. GitHub themselves seem to recommend to use their HMAC functionality (with shared secret) they provide (see GitHub's Securing your webhooks). In the Weblate documentation for the GitHub Webhook integration I don't see any way to authenticate the requests are actually coming from GitHub. I also don't see an option in settings.py to for example specify a shared secret.

Am I missing something here?

I already tried

• I've read and searched the documentation.
• I've searched for similar issues in this repository.

Steps to reproduce the behavior

.

Expected behavior

No response

Screenshots

No response

Exception traceback

No response

How do you run Weblate?

Git checkout

Weblate versions

No response

Weblate deploy checks

No response

Additional context

No response

[github-actions]

This issue looks more like a support question than an issue. We strive to answer these reasonably fast, but purchasing the support subscription is not only more responsible and faster for your business but also makes Weblate stronger.

In case your question is already answered, making a donation is the right way to say thank you!

[nijel]

There is currently no support for webhooks authentication. Weblate uses only repository URL and branch to detect which component to update.

[github-actions]

This issue has been automatically marked as stale because there wasn’t any recent activity.

It will be closed soon if no further action occurs.

Thank you for your contributions!