workflow-webhook

• Added support for authentication other than BASIC, for example, bearer tokens. See webhook_auth_type and webhook_auth in the README

• Improved environment variable handling (will now correctly handle variables set with either 'env' or 'with')
• Removed setting which indicates webhook_secret to be required

• Change curl option --fail to --fail-with-body
• If the webhook call fails with non 200 HTTP code, the result body will still be returned
• Removed the curl progress meter from verbose output

• Internal improvements to JSON handling

• Fixed bug with multi-line output in response-body for GITHUB_OUTPUT
• Added support for --max-time curl option
• Added rudimentary support for arbitrary, basic curl options to be passed in

• Fix a bug with the generation of SHA1 signature
• Return the webhook response from the action, using the GITHUB_OUTPUT variable

• The webhook secret is now optional. If omitted, the URL itself will be used as the value with which to generate the hash

• The X-GitHub-Delivery header now submits a UUID by default
• The name of the X-GitHub-Event can now be custom specified

Added support for connection timeout to be set

Output the unique request ID in the logs, unless silent=true

Improvements have been made in performance, by using a pre-built docker image hosted in the GitHub container registry. Also see the release notes for v2.0.0 for other important changes if you are upgrading from v1.

Using a pre-built docker image hosted in GitHub container registry

This is a major release, since some of the defaults that were previously applied have changed - the new defaults are more reasonable and secure. All v1 configurations options are still available, and the v1 tag will continue to exist in maintenance mode. To make use of the new features and defaults, use the v2 tag in your workflow config.

Two of the most important changes are:

• SSL certificates are now validated by default. For those who are not using verified SSL certs, and currently on v1 but wishes to use v2, should set verify_ssl: false (as per the README), otherwise your current workflow may fail.
• An additional log level has been added, which is something between verbose and silent. Those were the only two options available in v1 (and verbose may leak sensitive information in your logs). By default the logging in v2 will now give some basic output, and if you prefer verbose or silent instead, those options are still available.
• A unique requestID is set on each payload, which can be used to increase protection against replay attacks.

Thanks to @johannes-huther for these contributions.

Bug fix: remove duplicate 'User-Agent' in header

Support for sha256 header

An additional configuration option, allowing curl to be run in silent mode

Support an extended JSON webhook POST, which sends the complete GitHub even data, as found on GITHUB_EVENT_PATH

• Support for webhook endpoints that expect urlencoded form data
• Correctly handle curl HTTP failures, by letting errors bubble up

• Improved build time
• Allow unsigned SSL certificates
• Better curl usage
• Additional GitHub environment header

First official Marketplace release