feat(gocd): Add generic GoCD plugin with host egress auth - #1570
feat(gocd): Add generic GoCD plugin with host egress auth#1570sentry-junior[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Dashboard visual evidenceNo matching dashboard scenarios for this diff. |
Add @sentry/junior-gocd as a host-agnostic read-only GoCD package. Tools call through ctx.egress.fetch. Hosts supply base URL and either static bearer apiHeaders or grantForEgress/issueCredential hooks. Keep Sentry deploy topology and IAP defaults out of the OSS package. Co-Authored-By: Joshua Li <joshua.li@sentry.io>
9e14cdf to
c8b9f07
Compare
sentry-junior
Bot
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c8b9f07. Configure here.
| throw new Error("GoCD base URL must use https"); | ||
| } | ||
| return url.host; | ||
| } |
There was a problem hiding this comment.
Egress domains include non-default ports
High Severity
hostFromBaseUrl returns url.host, so a GoCD origin with a non-default HTTPS port becomes a domain like gocd.example.com:8154. Junior egress matches manifest.domains against URL.hostname, which never includes the port. Default GoCD (:8154) therefore fails domain ownership and never injects auth headers.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit c8b9f07. Configure here.
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
| throw new Error( | ||
| "GoCD base URL is required. Pass baseUrl, configure gocdPlugin({ baseUrl }), or set GOCD_URL.", |
There was a problem hiding this comment.
resolveGocdTarget skips base URL validation when options.host is set
When options.host is provided, hostFromBaseUrl is never called, so the https protocol check and URL validation it enforces are bypassed for the resolved baseUrl. This allows http:// URLs or invalid strings from plugin options or GOCD_URL to reach new Request or the egress fetch, violating the package's explicit https requirement.
Evidence
resolveGocdTargetresolveshostasinput.options?.host ?? hostFromBaseUrl(baseUrl)on line 68.- When
options.hostis truthy,hostFromBaseUrlis short-circuited, so itsnew URLparse andurl.protocol !== "https:"checks never run onbaseUrl. - This allows an
http://or malformedbaseUrlfromoptions.baseUrlorGOCD_URLto proceed. Anhttp://baseUrl reachesctx.egress.fetchvianew Request; an invalid string crashes there with a TypeError. input.baseUrlis validated by Zod.url(), but that still acceptshttp://schemes and does not enforcehttps.- Tests assert
hostFromBaseUrlrejectshttp://, yet no guard validatesbaseUrlindependently whenoptions.hostoverrides host extraction.
Identified by Warden · code-review · FC8-K53
Adds host-agnostic
@sentry/junior-gocdwith read-only pipeline history.Design
ctx.egress.fetchbaseUrl/GOCD_URLapiHeaderswithAuthorization: bearer ${GOCD_ACCESS_TOKEN}hooks.grantForEgress+hooks.issueCredentialfor extra headers (for example IAPProxy-Authorization)API contract
Checked against GoCD 25.2.0:
GET /go/api/pipelines/:name/historyAccept: application/vnd.go.cd.v1+jsonpage_sizeclamped to 10..100Follow-up
Sentry IAP/WIF wiring and deploy topology skill live in a
junior-prodhost PR after this package publishes.Requested by Joshua Li.
--
View Junior Session [Sentry]