Webhook add sends the secret in argv, which the server now refuses #21

closed cmc opened this on 2026-09-29 02:23 UTC

Discussion

cmc 2026-09-29 02:23 UTC

Since krz/gitbay#284, webhook add reads the signing secret from stdin only: --secret - with the secret on stdin; a literal --secret <value> is refused with exit 2. gitbay/Repos/WebhookViewModels.swift (~36-37) sends --secret <value> in argv, so adding a webhook with a secret from the app now fails.

Send ["--secret", "-"] in argv and the secret in the API request's stdin field.

closed by cmc in commit d7fac80c5f: Send the webhook secret on stdin

2026-09-29 02:49 UTC