* feat(JENKINS-73851): Add SHA-256 HMAC webhook signature validation
- Add SignatureAlgorithm enum with SHA-256 as default and SHA-1 for legacy support
- Extend GHWebhookSignature class to support SHA-256 HMAC computation
- Update HookSecretConfig to include configurable signature algorithm
- Modify RequirePostWithGHHookPayload.Processor to use configured algorithm
- Add comprehensive unit tests for SHA-256 functionality
- Maintain backwards compatibility with existing SHA-1 configurations
- Log deprecation warnings when SHA-1 is used
This implements GitHub's recommended SHA-256 HMAC signature validation
while maintaining backwards compatibility through configuration.
SHA-256 becomes the default for enhanced security.
Resolves: JENKINS-73851
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(JENKINS-73851): Add UI for signature algorithm selection
- Add doFillSignatureAlgorithmItems() method to provide dropdown options
- Create signature algorithm selection dropdown in Jenkins configuration UI
- Add help documentation for signature algorithm selection
- Update HookSecretConfig constructor to parse algorithm from UI string input
- Add parseSignatureAlgorithm() method with case-insensitive parsing
- Update tests to work with new string-based constructor
- Add comprehensive test cases for algorithm parsing edge cases
Users can now choose between SHA-256 (Recommended) and SHA-1 (Legacy)
signature algorithms through the Jenkins UI in the GitHub plugin
configuration section.
The dropdown properly displays both options with SHA-256 set as default
for enhanced security, while SHA-1 remains available for legacy compatibility.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(JENKINS-73851): Fix checkstyle violations in SHA-256 implementation
- Remove trailing whitespace from all modified files
- Fix line length violations by properly wrapping long lines
- Fix operator wrap issues by placing operators on new lines
- Maintain consistent code formatting throughout
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* chore: Remove .vscode/settings.json and add to .gitignore
- Remove IDE-specific configuration file from version control
- Add .vscode/ directory to .gitignore to prevent future tracking
- Keep IDE configurations local to individual developer environments
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(JENKINS-73851): Add system property override for default signature algorithm
- Add jenkins.github.webhook.signature.default system property
- Allows overriding default from SHA-256 to SHA-1 for CI compatibility
- Maintains SHA-256 as secure default when no property is set
- Dynamic evaluation prevents static initialization issues
- Added comprehensive test coverage and documentation
Usage:
- Default: SHA-256 (secure)
- CI override: -Djenkins.github.webhook.signature.default=SHA1
- Invalid values fallback to SHA-256
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(JENKINS-73851): Fix failing tests
---------
Co-authored-by: Jason Heithoff <jasonheithoff@MacBookPro.attlocal.net>
Co-authored-by: Claude <noreply@anthropic.com>
No description provided.