Repository navigation
fix(announce): let webhook headers override the default headers - #7174
Merged
caarlos0 merged 1 commit intoOct 6, 2026
Merged
Conversation
caarlos0
enabled auto-merge
October 3, 2026 17:43
Member
|
thanks! |
The webhook announcer sets Content-Type, User-Agent and, from BASIC_AUTH_HEADER_VALUE/BEARER_TOKEN_HEADER_VALUE, Authorization, and then adds the entries from `headers` with `Header.Add`. A key the user sets in `headers` is therefore appended instead of replacing the default: - User-Agent is dropped, as net/http only sends the first value, so the receiver always sees "goreleaser"; - Content-Type is sent twice; - Authorization is sent twice when one of the auth env vars is set. Use `Header.Set` for the configured headers so the value in `headers` wins, as every other announcer already does. The docs example used `User-Agent: "goreleaser"`, the same as the default, which hid the bug. It now uses a different value, and the docs say that `headers` overrides the defaults. Tests check `Header.Values` on the receiving side, so duplicates are caught. They fail before this change and pass after it. Closes goreleaser#7173 AI-assisted: written with Claude Code, reviewed and tested by me before sending. Assisted-by: Claude
auto-merge was automatically disabled
October 4, 2026 05:22
Head branch was pushed to by a user without write access
NitinKumar004
force-pushed
the
fix-webhook-header-override
branch
from
October 4, 2026 05:22
8acbc2f to
97b2838
Compare
Contributor
Author
|
Thanks! The lint and test failures came from the old base: the lint error was in |
caarlos0
enabled auto-merge
October 6, 2026 00:11
caarlos0
approved these changes
Oct 6, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7174 +/- ##
==========================================
+ Coverage 91.58% 91.59% +0.01%
==========================================
Files 192 192
Lines 15939 15939
==========================================
+ Hits 14598 14600 +2
+ Misses 1341 1339 -2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make entries in
announce.webhook.headersreplace the headers goreleasersets by default (Content-Type, User-Agent, and Authorization from the
auth env vars) instead of being appended next to them.
The custom headers loop used
req.Header.Add. For a key goreleaser hadalready set, that produced two values. User-Agent from
headerswassilently ignored, because net/http only sends the first one. Content-Type
was sent twice. Authorization was sent twice whenever
BASIC_AUTH_HEADER_VALUE or BEARER_TOKEN_HEADER_VALUE was also set.
The fix is one line:
AddbecomesSetin that loop. That matches whatthe other announcers do (discord, discourse, mattermost, telegram, ...).
I added two tests that look at
r.Header.Values(...)on the server, so aduplicate value fails them. The docs example used
User-Agent: "goreleaser", the same as the default, which is why thiswent unnoticed. It now uses
my-bot/1.0and says thatheadersoverrides the defaults.
With this change, a configured
Authorizationheader takes precedenceover the env vars. If you would rather the env vars win, I can flip the
order. Either way there will be only one value.
The three default headers are also set with
Add. They could beSetfor consistency, but behaviour is the same since the request starts
empty, so I left them alone to keep the diff small.
Closes #7173
I used an AI assistant (Claude Code) to help find, fix and test this.
I've reviewed the changes and ran the tests myself.