Created tests with @Issue("JENKINS-76080") annotation to better understand the behavior described by users. I was able to recreate the issue when a shared secret config was created in jenkins but no share secret jenkins credential was created or selected. When the payload is sent to /github-webhook/ endpoint without Github's X-Hub-Signature headers the HTTP 400 error is returned.
Testing done
Submitter checklist
Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
Ensure that the pull request title represents the desired changelog entry
Please describe what you did
Link to relevant issues in GitHub or Jira
Link to relevant pull requests, esp. upstream and downstream changes
Ensure you have provided tests that demonstrate the feature works or the issue is fixed
HybridProgrammer
changed the title
JENKINS-76080 - Validate signatures without secret when not configured
JENKINS-76080 - Validate signatures fix when secrets are not set
Sep 13, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Created tests with @Issue("JENKINS-76080") annotation to better understand the behavior described by users. I was able to recreate the issue when a shared secret config was created in jenkins but no share secret jenkins credential was created or selected. When the payload is sent to /github-webhook/ endpoint without Github's X-Hub-Signature headers the HTTP 400 error is returned.
Testing done
Submitter checklist
This change is