Provisioning: Mark repository as unhealthy if hooks fail (#109788)

pkg/registry/apis/provisioning/webhooks/register.go

@@ -34,6 +34,16 @@ type WebhookExtraBuilder struct {
 	provisioningapis.ExtraBuilder
 }
 
+// HACK: assume that the URL is public if it starts with "https://" and does not contain any local IP ranges
+func isPublicURL(url string) bool {
+	return strings.HasPrefix(url, "https://") &&
+		!strings.Contains(url, "localhost") &&
+		!strings.HasPrefix(url, "https://127.") &&
+		!strings.HasPrefix(url, "https://192.") &&
+		!strings.HasPrefix(url, "https://10.") &&
+		!strings.HasPrefix(url, "https://172.16.")
+}
+
 func ProvideWebhooks(
 	cfg *setting.Cfg,
 	features featuremgmt.FeatureToggles,
@@ -48,8 +58,8 @@ func ProvideWebhooks(
 			urlProvider := func(_ string) string {
 				return cfg.AppURL
 			}
-			// HACK: Assume is only public if it is HTTPS
-			isPublic := strings.HasPrefix(urlProvider(""), "https://")
+
+			isPublic := isPublicURL(urlProvider(""))
 			clients := resources.NewClientFactory(configProvider)
 			parsers := resources.NewParserFactory(clients)
 
@@ -74,6 +84,7 @@ func ProvideWebhooks(
 				filepath.Join(cfg.DataPath, "clone"),
 				parsers,
 				[]jobs.Worker{pullRequestWorker},
+				isPublic, // Pass the public URL flag
 			)
 		},
 	}
@@ -90,6 +101,7 @@ type WebhookExtra struct {
 	clonedir    string
 	parsers     resources.ParserFactory
 	workers     []jobs.Worker
+	isPublic    bool // Flag to determine if webhook-enhanced repositories should be created
 }
 
 func NewWebhookExtra(
@@ -101,6 +113,7 @@ func NewWebhookExtra(
 	clonedir string,
 	parsers resources.ParserFactory,
 	workers []jobs.Worker,
+	isPublic bool,
 ) *WebhookExtra {
 	return &WebhookExtra{
 		render:      render,
@@ -111,6 +124,7 @@ func NewWebhookExtra(
 		clonedir:    clonedir,
 		parsers:     parsers,
 		workers:     workers,
+		isPublic:    isPublic,
 	}
 }
 
@@ -155,7 +169,8 @@ func (e *WebhookExtra) GetJobWorkers() []jobs.Worker {
 
 // AsRepository delegates repository creation to the webhook connector
 func (e *WebhookExtra) AsRepository(ctx context.Context, r *provisioning.Repository) (repository.Repository, error) {
-	if r.Spec.Type == provisioning.GitHubRepositoryType {
+	// Only handle GitHub repositories with webhooks if URL is public
+	if r.Spec.Type == provisioning.GitHubRepositoryType && e.isPublic {
 		gvr := provisioning.RepositoryResourceInfo.GroupVersionResource()
 		webhookURL := fmt.Sprintf(
 			"%sapis/%s/%s/namespaces/%s/%s/%s/webhook",
@@ -209,7 +224,11 @@ func (e *WebhookExtra) AsRepository(ctx context.Context, r *provisioning.Reposit
 }
 
 func (e *WebhookExtra) RepositoryTypes() []provisioning.RepositoryType {
-	return []provisioning.RepositoryType{
-		provisioning.GitHubRepositoryType,
+	// Only claim to handle GitHub repositories if URL is public
+	if e.isPublic {
+		return []provisioning.RepositoryType{
+			provisioning.GitHubRepositoryType,
+		}
 	}
+	return []provisioning.RepositoryType{}
 }