Skip to content

fix(announce): let webhook headers override the default headers - #7174

Merged
caarlos0 merged 1 commit into
goreleaser:mainfrom
NitinKumar004:fix-webhook-header-override
Oct 6, 2026
Merged

caarlos0 merged 1 commit into
goreleaser:mainfrom
NitinKumar004:fix-webhook-header-override

Conversation

@NitinKumar004

Copy link
Copy Markdown
Contributor

Make entries in announce.webhook.headers replace the headers goreleaser
sets by default (Content-Type, User-Agent, and Authorization from the
auth env vars) instead of being appended next to them.

The custom headers loop used req.Header.Add. For a key goreleaser had
already set, that produced two values. User-Agent from headers was
silently ignored, because net/http only sends the first one. Content-Type
was sent twice. Authorization was sent twice whenever
BASIC_AUTH_HEADER_VALUE or BEARER_TOKEN_HEADER_VALUE was also set.

The fix is one line: Add becomes Set in that loop. That matches what
the other announcers do (discord, discourse, mattermost, telegram, ...).
I added two tests that look at r.Header.Values(...) on the server, so a
duplicate value fails them. The docs example used
User-Agent: "goreleaser", the same as the default, which is why this
went unnoticed. It now uses my-bot/1.0 and says that headers
overrides the defaults.

With this change, a configured Authorization header takes precedence
over the env vars. If you would rather the env vars win, I can flip the
order. Either way there will be only one value.

The three default headers are also set with Add. They could be Set
for consistency, but behaviour is the same since the request starts
empty, so I left them alone to keep the diff small.

Closes #7173

I used an AI assistant (Claude Code) to help find, fix and test this.
I've reviewed the changes and ran the tests myself.

@pull-request-size pull-request-size Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 2, 2026
@caarlos0
caarlos0 enabled auto-merge October 3, 2026 17:43
@caarlos0

caarlos0 commented Oct 3, 2026

Copy link
Copy Markdown
Member

thanks!

The webhook announcer sets Content-Type, User-Agent and, from
BASIC_AUTH_HEADER_VALUE/BEARER_TOKEN_HEADER_VALUE, Authorization, and
then adds the entries from `headers` with `Header.Add`. A key the user
sets in `headers` is therefore appended instead of replacing the
default:

- User-Agent is dropped, as net/http only sends the first value, so the
  receiver always sees "goreleaser";
- Content-Type is sent twice;
- Authorization is sent twice when one of the auth env vars is set.

Use `Header.Set` for the configured headers so the value in `headers`
wins, as every other announcer already does. The docs example used
`User-Agent: "goreleaser"`, the same as the default, which hid the bug.
It now uses a different value, and the docs say that `headers`
overrides the defaults.

Tests check `Header.Values` on the receiving side, so duplicates are
caught. They fail before this change and pass after it.

Closes goreleaser#7173

AI-assisted: written with Claude Code, reviewed and tested by me before
sending.

Assisted-by: Claude
auto-merge was automatically disabled October 4, 2026 05:22

Head branch was pushed to by a user without write access

@NitinKumar004
NitinKumar004 force-pushed the fix-webhook-header-override branch from 8acbc2f to 97b2838 Compare October 4, 2026 05:22
@NitinKumar004

Copy link
Copy Markdown
Contributor Author

Thanks! The lint and test failures came from the old base: the lint error was in internal/pipe/ko/ko.go and the test failure was a Docker pull error in internal/pipe/blob, both already fixed on main. I rebased onto main, and build, tests and lint pass locally now. Pushing turned off auto-merge and the workflows need approval to run again, sorry about that.

@caarlos0
caarlos0 enabled auto-merge October 6, 2026 00:11
@codecov

codecov Bot commented Oct 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.59%. Comparing base (61704ff) to head (97b2838).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7174      +/-   ##
==========================================
+ Coverage   91.58%   91.59%   +0.01%     
==========================================
  Files         192      192              
  Lines       15939    15939              
==========================================
+ Hits        14598    14600       +2     
+ Misses       1341     1339       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@caarlos0
caarlos0 added this pull request to the merge queue Oct 6, 2026
Merged via the queue into goreleaser:main with commit 6f22aef Oct 6, 2026
19 checks passed
@github-actions github-actions Bot added this to the v2.18.0 milestone Oct 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

webhook announcer: headers can't override User-Agent, and duplicates Content-Type/Authorization

2 participants

⌂ 换网址