Changeset 3983

Timestamp:

09/07/2016 06:02:21 AM (8 years ago)

Author:

dd32

Message:

GitHub Sync: Add support for the application/x-www-form-urlencoded webhook format and add documentation.

Location:

sites/trunk/api.wordpress.org/public_html/dotorg/github-sync

Files:

• feature-plugins.php (modified) (2 diffs)
• feature-plugins.sh (modified) (2 diffs)

sites/trunk/api.wordpress.org/public_html/dotorg/github-sync/feature-plugins.php

@@ -1 +1 @@
 <?php
 /**
- * A easy webhook to allow feature plugins to be sync'd to WordPress.org plugins SVN easier.
+ * This webhook is very basic, but handles syncing a select few featured plugins over to plugins.svn.wordpress.org during development.
+ *
+ * To have your *feature project* handled by this sync script:
+ * - Ensure you're listed on https://make.wordpress.org/core/features-as-plugins/ if you're not, ping in #meta
+ * - Ping in #meta to get your project added to the whitelist within this file
+ * - Add `https://api.wordpress.org/dotorg/github-sync/feature-plugins.php` as a `push` webhook on github with the secret we'll provide you.
+ * - Push to github master and watch https://plugins.trac.wordpress.org/log/$plugin_slug/
+ * - Profit from all the Open Source points you're getting!
  */
 
@@ -8 +15 @@
 class GH2WORG {
 
-    private $whitelisted_repos = array(
-        // Github User/Repo => plugins.svn.wordpress.org/****/trunk/
-        'dd32/feature-plugin-testing' => 'test-plugin-3',
-        'voldemortensen/menu-customizer' => 'menu-customizer',
-        'georgestephanis/two-factor' => 'two-factor',
+    private $whitelisted_repos = [
+        // Github.com/{$user/repo-name} => plugins.svn.wordpress.org/{$slug}/trunk/
+        'dd32/feature-plugin-testing'           => 'test-plugin-3',
+        'georgestephanis/two-factor'            => 'two-factor',
         'georgestephanis/application-passwords' => 'application-passwords',
-        'obenland/shiny-updates' => 'shiny-updates',
-        'pento/react' => 'react',
-    );
+        'obenland/shiny-updates'                => 'shiny-updates',
+        'pento/react'                           => 'react',
+    ];
 
     function __construct() {
-        $this->populate_post_vars();
-
-        if ( ! $this->verify_github_signature() ) {
-            die( 'Cheating, huh?' );
-        }
-
-        $repo_name = $_POST['repository']['full_name'];
-        $repo_url  = $_POST['repository']['git_url'];
-
-        if ( ! $this->verify_valid_plugin( $repo_name ) ) {
-            die( 'Sorry, This Github repo is not configured for WordPress.org Plugins SVN Github Sync. Please contact us.' );
-        }
+        $repo_name = $this->get_notified_repo();
 
         $svn_directory = $this->whitelisted_repos[ $repo_name ];
 
-        $this->process_github_to_svn( $repo_url, $svn_directory );
+        if ( ! $repo_name || ! $svn_directory ) {
+            die( 'Sorry, This Github repo is not configured for WordPress.org Plugins SVN Github Sync. Please ping in #meta on Slack for assistance.' );
+        }
+
+        $this->process_github_to_svn( $repo_name, $svn_directory );
     }
 
-    function populate_post_vars() {
-        if ( 'application/json' == $_SERVER['HTTP_CONTENT_TYPE'] ) {
-            $_POST = @json_decode( file_get_contents('php://input'), true );
-        } else {
-            // Assuming Magic Quotes disabled like a good host.
-            $_POST = @json_decode( $_POST['payload'], true );
+    /**
+     * Determines the Github Repo (user/repo) which Github is notifying us about.
+     *
+     * - Extracts the repo from both `application/json` and `application/x-www-form-urlencoded` webhook variants.
+     * - Verifies the signature of the request
+     *
+     * @return string|bool Github repo on success, false on failure.
+     */
+    function get_notified_repo() {
+        $github_payload = file_get_contents( 'php://input' );
+        $signature_of_payload = 'sha1=' . hash_hmac( 'sha1', $github_payload, FEATURE_PLUGIN_GH_SYNC_SECRET );
+
+        if ( ! hash_equals( $signature_of_payload, $_SERVER['HTTP_X_HUB_SIGNATURE'] ) ) {
+            return false;
         }
+
+        /*
+         * Extract the payload from the `php://input` stream, although this is also present in
+         * $_POST, the Github signature is of this raw data, so we'll use that data.
+         */
+        if ( 'application/x-www-form-urlencoded' === $_SERVER['HTTP_CONTENT_TYPE'] ) {
+            parse_str( $github_payload, $github_payload );
+            $github_payload = $github_payload['payload'];
+        }
+
+        return json_decode( $github_payload, true )['repository']['full_name'];
     }
 
-    function verify_github_signature() {
-        if ( empty( $_SERVER['HTTP_X_HUB_SIGNATURE'] ) )
-            return false;
+    /**
+     * Triggers the shell script to migrate the Git commit to plugins.svn
+     *
+     * @param string $github_repo   The Github Repo which was modified (user/repo).
+     * @param string $svn_directory The plugins.svn directory/plugin (plugin-slug).
+     */
+    function process_github_to_svn( $github_repo, $svn_directory ) {
 
-        list( $algo, $hash ) = explode( '=', $_SERVER['HTTP_X_HUB_SIGNATURE'], 2 );
-
-        // Todo? Doesn't handle standard $_POST, only application/json
-        $hmac = hash_hmac( $algo, file_get_contents('php://input' ), FEATURE_PLUGIN_GH_SYNC_SECRET );
-
-        return $hash === $hmac;
-    }
-
-    function verify_valid_plugin( $repo ) {
-        return isset( $this->whitelisted_repos[ $repo ] );
-    }
-
-    function process_github_to_svn( $github_url, $svn_directory ) {
-
-        putenv( 'PHP_SVN_USER=' . FEATURE_PLUGIN_GH_SYNC_USER );
+        putenv( 'PHP_SVN_USER='     . FEATURE_PLUGIN_GH_SYNC_USER );
         putenv( 'PHP_SVN_PASSWORD=' . FEATURE_PLUGIN_GH_SYNC_PASS );
 
-        echo shell_exec( __DIR__ . "/feature-plugins.sh $github_url $svn_directory 2>&1" );
+        $github_repo   = escapeshellarg( $github_repo );
+        $svn_directory = escapeshellarg( $svn_directory );
+
+        echo shell_exec( __DIR__ . "/feature-plugins.sh $github_repo $svn_directory 2>&1" );
 
         putenv( 'PHP_SVN_USER' );

sites/trunk/api.wordpress.org/public_html/dotorg/github-sync/feature-plugins.sh

@@ -1 +1 @@
 #!/bin/bash
 
-GITHUB_URL=$1;
+GITHUB_REPO=$1;
 SVN_PLUGIN=$2;
 
@@ -16 +16 @@
 
 # Validate all Parameters are present
-if [ ! $GITHUB_URL ] || [ ! $SVN_PLUGIN ] || [ ! $PHP_SVN_USER ] || [ ! $PHP_SVN_PASSWORD ]; then
+if [ ! $GITHUB_REPO ] || [ ! $SVN_PLUGIN ] || [ ! $PHP_SVN_USER ] || [ ! $PHP_SVN_PASSWORD ]; then
     echo "Invalid Input, missing parameter"; exit 1
 fi
 
+GITHUB_URL="git://github.com/$GITHUB_REPO.git"
 SVN_URL="https://plugins.svn.wordpress.org/$SVN_PLUGIN/trunk/"
 ASSETS_SVN_URL="https://plugins.svn.wordpress.org/$SVN_PLUGIN/assets/"