Jenkins and GitHub webhook: HTTP 403

问题:

I have a GitHub repository which I would like to have notify Jenkins of new commits via a post-receive hook. I've installed the GitHub plugin into Jenkins and have allowed for Jenkins to manage it's own hook URLs. The project has the correct git repository URL and is instructed to "Build when a change is pushed to GitHub". When I have GitHub send a test payload I find this in the nginx webserver that front's Jenkins:

207.97.227.233 - - [15/Sep/2011:07:36:51 +0000] "POST /github-webhook/ HTTP/1.1" 403 561 "-" "-"

I was running SSL so I disabled it to no effect. Do I need to provide special permissions to an anonymous user in the permissions matrix?

Please forgive the lack of configuration files: I'm happy to share those that might exist but I don't know what might be useful to share.

回答1:

As I don't allow anonymous access, it turns out I needed to create a specific user for GitHub pushes and to grant it Overall read, Job create and Job read. It was also necessary to bundle the authentication into the webhook URL, like so:

https://foo:[e-mail]/github-webhook/

回答2:

As previously mentioned Jenkins does not allow anonymous access (you don't want people to trigger builds for you!). Adding a username and password in the clear is not the best solution.

1) If your Jenkins is behind a VPN, you need to make sure that your Jenkins webhooks URL are exposed

2) In the GitHub plugin configuration add the correct accessible Jenkins webhook URL(https://jenkins.example.com/github-webhook/) in Override Hook URL

3) Add a secret in the Shared secret section (preferably a long random string). This would be a token sent from Jenkins to GitHub and vice versa for authentication. This should be different from the GitHub Server Credentials!

4) Make sure the user has owner access to add webhooks to your GitHub repos

5) Don't forget to re-register the webhooks after this

回答3:

https://username:[e-mail]/github-webhook/ worked for me but the password has to be encoded for the payload to work. My github was not able to contact jenkins due to nginx authorisation but passing username and encoded password worked!