Skip to content
Switch branches/tags

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Brigade OAuth Gateway

Note: this is the initial GitHub gateway that shipped with Brigade, and uses a per-repository OAuth model. The new, and recommended way, is to use the GitHub app model, implemented in this repo.

GitHub Integration

Brigade provides GitHub integration for triggering Brigade builds from GitHub events.

Brigade integrates with GitHub by providing GitHub webhook implementations for the following events:

  • push: Fired whenever something is pushed
  • pull_request: Fired whenever a pull request's state is changed. See the action value in the payload, which will be one of the following:
    • opened
    • reopened
    • synchronize
    • closed
  • pull_request:labeled: Fired whenever a label is added to a pull request.
  • pull_request:unlabeled: Fired whenever a label is removed from a pull request.
  • create: Fired when a tag, branch, or repo is created.
  • release: Fired when a new release is created.
  • status: Fired when a status change happens on a commit.
  • commit_comment: Fired when a comment is added to a commit.

You must be running brigade-github-gateway in a way that makes it available to GitHub. (For example, assign it a publicly routable IP and domain name.)

Configuring Your Project

Brigade uses projects to tie repositories to builds. Check out the project documentation if you haven't already.

When creating a project with brig project create, the following information is required for GitHub integration to function:

  1. Repository name, e.g.
  2. Clone URL, e.g.
  3. A shared secret for GitHub Webhooks (this will be auto-generated if not provided)
  4. A GitHub Oauth2 token

Assuming these values have been entered, the resulting project should be good to go.

Configuring GitHub

To add a Brigade project to GitHub:

  1. Go to "Settings"
  2. Click "Webhooks"
  3. Click the "Add webhook" button
  4. For "Payload URL", add the URL: "http://YOUR_HOSTNAME:7744/events/github"
  5. For "Content type", choose "application/json"
  6. For "Secret", use the shared secret configured via brig above.
  7. Choose "Just the push event" or choose specific events you want to receive, such as "push" and "pull_request".

Each event you select here will increase the number of events that fire within the Brigade system. We recommend only enabling the events that you are using, as enabling unused events will merely result in extra load on your system.

GitHub Webhook Config

You may use GitHub's testing page to verify that GitHub can successfully send an event to the Brigade gateway.

Finding Your Gateway's URL

To find your "Payload URL" IP address, you can run this command on your Kubernetes cluster:

$ kubectl get service
NAME                  TYPE           CLUSTER-IP   EXTERNAL-IP   PORT(S)          AGE
brigade-brigade-api   ClusterIP    <none>        7745/TCP         8h
brigade-brigade-gw    LoadBalancer    7744:31946/TCP   8h

The EXTERNAL-IP for the brigade-gw service is the one you will use. You can map this to a DNS name if you wish.

The gateway listens on port 7744, so the URL for the above will be

Protectecting Your Gateway with SSL/TLS

You may optionally set up an NGINX SSL proxy in front of your Brigade Gateway (brigade-gw) service. This can be done using cert-manager or kube lego.

Please note that cert-manager is pre-1.0, and does not currently offer strong guarantees around the API stability and kube-lego is in maintenance mode only, with Kubernetes 1.8 as the last release with official support

cert-manager is the the officially endorsed successor of kube-lego. Here are some resources for installing and configuring cert-manager for Azure Kubernetes Service and for Google Kubernetes Engine.

In this case, once the NGINX proxy is set up with SSL, you can point your GitHub "Payload URL" to the proxy instead of directly at the brigade-gw service.

Configuring the GitHub Gateway

Running Pull Requests from untrusted parties is dangerous. It can consume your Brigade resources, or even (in some cases) allow access to private information like your project.secrets.

For that reason, the Brigade GitHub gateway tries to protect your repo by default.

  1. By default, when you install Brigade, the GitHub gateway is configured to ignore pull requests that come from forks.

  2. By default, your Brigade GitHub gateway is configured to ONLY build PRs that were submitted by authors with trusted roles:

  • OWNER: The repo owner
  • COLLABORATOR: Someone who is an invited collaborator on the project
  • MEMBER: Someone who is a member of the organization that this repo belongs to

There are two configuration options that can alter these defaults:

  • gw.buildForkedPullRequests: This can be set to true to allow forked pull requests to build. If this is true, the author check is applied to these users.
  • gw.allowedAuthorRoles: This is a list of author roles that are allowed to build PRs. This list is always applied, whether the PR is from forked repository or not.

Here is an example that upgrades Brigade to allow forked builds, but only from the OWNER and COLLABORATOR author roles:

$ helm upgrade brigade brigade/brigade \
  --set gw.buildForkedPullRequests=true \
  --set gw.allowedAuthorRoles=COLLABORATOR\,OWNER \

Note that this configuration will not eliminate all possibilities of mis-use (a comprimized GitHub account is still a vector of attack). But it will restrict PRs to only accounts that are owners or collaborators (invited contributors) on the main repository.

Connecting to Private GitHub Repositories (or Using SSH)

Sometimes it is better to configure Brigade to interact with GitHub via SSH. For example, if your repository is private and you don't want to allow anonymous Git clones, you may need to use an SSH GitHub URL. To use GitHub with SSH, you will also need to create a Deployment Key.

To create a new GitHub Deployment Key, generate an SSH key. On UNIX-like systems, this is done with ssh-keygen -f ./github_deployment_key. When prompted to set a passphrase, do not set a passphrase.

ssh-keygen -f ./github_deployment_key
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ./github_deployment_key.
Your public key has been saved in ./

In GitHub, navigate to your project, choose Settings (the gear icon), then choose Depoyment Keys from the left-hand navigation. Click the Add deploy key button.

The Title field should be something like brigade-checkout, though the intent of this field is just to help you remember that this key was used by Brigade.

The Key field should be the content of the ./ file generated by ssh-keygen above.

Save that key.

Inside of your project configuration for your brigade-project, make sure to add your key:


project: "my/brigade-project"
repository: ""
# This is an SSH clone URL
cloneURL: ""
# paste your entire key here:
sshKey: |-
  # removed some lines
# The rest of your config...

Then you can install (or upgrade) your project:

$ helm install -n my-project brigade/brigade-project -f myvalues.yaml

Now your project is configured to clone via SSH using the deployment key we generated.


This Brigade project accepts contributions via GitHub pull requests. This document outlines the process to help get your contribution accepted.

Signed commits

A DCO sign-off is required for contributions to repos in the brigadecore org. See the documentation in Brigade's Contributing guide for how this is done.


GitHub OAuth Gateway for Brigade v1





No releases published


No packages published

Contributors 4