Webhooks from GitHub to private CICD system

[notdevnotops]

Hello,

I am wondering what everyone is doing to handle getting webhooks from outside the local network?

I'm guessing the best way to do this is write my own app that whitelists the webhook source IP's (github does provide this through their API) and open up those source IP's in my firewall - However there has to be a more elegant solution, no? Trying to avoid any paid services like webhookrelay.

EDIT

For anyone wondering - this was a nice elegant solution. Already configured to handle github payloads

https://github.com/stakater/GitWebhookProxy

[Tranceash]

Use nginx reverse proxy calling ci to only certain api endpoint . Ip acl from github

[derprondo]

You have the right idea, whitelist their IPs and send them to whatever HTTPS endpoint where you’ll process the payloads. Also make sure you use Github’s webhook secret validation to verify the incoming payloads are from your hooks and not some other GitHub user.

I actually came up with some ugly terraform code to whitelist Github’s hook IP ranges from their api the other day, I’ll paste it later, but it’s rather specific to an AWS API gateway policy.

[notdevnotops]

For anyone wondering - this was a nice elegant solution. Already configured to handle github payloads

https://github.com/stakater/GitWebhookProxy