Merge branch '31333-add-gitlab-instance-header-to-webhooks' into 'master'

Add X-Gitlab-Instance header to webhooks

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/98624



Merged-by: George Koltsov <gkoltsov@gitlab.com>
Approved-by: Alex Kalderimis <akalderimis@gitlab.com>
Approved-by: George Koltsov <gkoltsov@gitlab.com>
Co-authored-by: Luke Duncalfe <lduncalfe@eml.cc>

app/services/web_hook_service.rb

@@ -197,6 +197,10 @@ def build_headers
         Gitlab::WebHooks::GITLAB_EVENT_HEADER => self.class.hook_to_event(hook_name)
       }
 
+      if Feature.enabled?(:webhooks_gitlab_instance_header)
+        headers[Gitlab::WebHooks::GITLAB_INSTANCE_HEADER] = Gitlab.config.gitlab.base_url
+      end
+
       headers['X-Gitlab-Token'] = Gitlab::Utils.remove_line_breaks(hook.token) if hook.token.present?
       headers.merge!(Gitlab::WebHooks::RecursionDetection.header(hook))
     end

config/feature_flags/development/webhooks_gitlab_instance_header.yml

+---
+name: webhooks_gitlab_instance_header
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/98624
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/375001
+milestone: '15.5'
+type: development
+group: group::integrations
+default_enabled: false

doc/user/project/integrations/webhooks.md

@@ -234,6 +234,23 @@ Image URLs are not rewritten if:
 
 For more information about supported events for Webhooks, go to [Webhook events](webhook_events.md).
 
+## Delivery headers
+
+> `X-Gitlab-Instance` header introduced in GitLab 15.5 [with a flag](../../../administration/feature_flags.md) named `webhooks_gitlab_instance_header`. Disabled by default.
+
+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available,
+ask an administrator to [enable the feature flag](../../../administration/feature_flags.md) named `webhooks_gitlab_instance_header`.
+The feature is not ready for production use.
+
+Webhook requests to your endpoint include the following headers:
+
+| Header | Description | Example |
+| ------ | ------ | ------ |
+| `User-Agent` | In the format `"Gitlab/<VERSION>"`. | `"GitLab/15.5.0-pre"` |
+| `X-Gitlab-Event` | Name of the webhook type. Corresponds to [event types](webhook_events.md) but in the format `"<EVENT> Hook"`. | `"Push Hook"` |
+| `X-Gitlab-Instance` | Hostname of the GitLab instance that sent the webhook. | `"https://gitlab.com"` |
+
 ## Troubleshoot webhooks
 
 > **Recent events** for group webhooks [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/325642) in GitLab 15.3.

lib/gitlab/web_hooks.rb

@@ -3,5 +3,6 @@
 module Gitlab
   module WebHooks
     GITLAB_EVENT_HEADER = 'X-Gitlab-Event'
+    GITLAB_INSTANCE_HEADER = 'X-Gitlab-Instance'
   end
 end

spec/services/web_hook_service_spec.rb

@@ -75,7 +75,8 @@
         'Content-Type' => 'application/json',
         'User-Agent' => "GitLab/#{Gitlab::VERSION}",
         'X-Gitlab-Event' => 'Push Hook',
-        'X-Gitlab-Event-UUID' => uuid
+        'X-Gitlab-Event-UUID' => uuid,
+        'X-Gitlab-Instance' => Gitlab.config.gitlab.base_url
       }
     end
 
@@ -164,7 +165,7 @@
       end
     end
 
-    it 'POSTs the data as JSON' do
+    it 'POSTs the data as JSON and returns expected headers' do
       stub_full_request(project_hook.url, method: :post)
 
       service_instance.execute
@@ -174,6 +175,22 @@
       ).once
     end
 
+    context 'when webhooks_gitlab_instance_header flag is disabled' do
+      before do
+        stub_feature_flags(webhooks_gitlab_instance_header: false)
+      end
+
+      it 'excludes the X-Gitlab-Instance header' do
+        stub_full_request(project_hook.url, method: :post)
+
+        service_instance.execute
+
+        expect(WebMock).to have_requested(:post, stubbed_hostname(project_hook.url)).with(
+          headers: headers.except('X-Gitlab-Instance')
+        ).once
+      end
+    end
+
     context 'when the data is a Gitlab::DataBuilder::Pipeline' do
       let(:pipeline) { create(:ci_pipeline, project: project) }
       let(:data) { ::Gitlab::DataBuilder::Pipeline.new(pipeline) }