GitLab webhook

Failed pipelines and deployments, new merge requests and created releases.

Setup

1. In GitLab open the project, then Settings, Webhooks, Add new webhook.
2. Create the webhook with a signing token. GitLab shows the token (it starts with whsec_) once, so copy it now. Use a temporary URL such as https://example.com until PingLoom gives you the real one.
3. In PingLoom open Webhooks, choose New webhook source, pick GitLab, paste the signing token and create it. Copy the endpoint URL.
4. Back in GitLab edit the webhook, paste the PingLoom endpoint URL and tick Pipeline events, Merge request events, Deployment events and Releases events.
5. Use Test in GitLab. The request appears under Recent requests on the PingLoom source page.

Verification

GitLab signs with a signing token using the Standard Webhooks scheme: webhook-id, webhook-timestamp and webhook-signature (HMAC-SHA256 over id.timestamp.body, key from the whsec_ token). PingLoom rejects requests more than five minutes old and uses webhook-id to drop repeats. The older plain Secret token header is weaker and is not accepted.

Events

You choose which events become alerts when you create the source, and you can change it later on the source page.

Signing tokens need a GitLab version that supports them. If your token cannot be kept when you edit the URL, create the webhook again with the real URL.