Only react to pushes on gh-pages branch

Author: QuLogic

test_webhook.py

@@ -165,11 +165,23 @@ async def test_github_webhook_valid(aiohttp_client, monkeypatch):
     assert resp.status == 200
     ur_mock.assert_not_called()
 
-    # Push event should run an update.
+    # Push event to main branch should do nothing.
     resp = await client.post(
         '/gh/non-existent-repo',
         headers={**valid_headers, 'X-GitHub-Event': 'push'},
         data='{"sender": {"login": "QuLogic"},'
+             ' "ref": "refs/heads/main",'
+             ' "repository": {"name": "non-existent-repo",'
+             ' "owner": {"login": "matplotlib"}}}')
+    assert resp.status == 200
+    ur_mock.assert_not_called()
+
+    # Push event to gh-pages branch should run an update.
+    resp = await client.post(
+        '/gh/non-existent-repo',
+        headers={**valid_headers, 'X-GitHub-Event': 'push'},
+        data='{"sender": {"login": "QuLogic"},'
+             ' "ref": "refs/heads/gh-pages",'
              ' "repository": {"name": "non-existent-repo",'
              ' "owner": {"login": "matplotlib"}}}')
     assert resp.status == 200

webhook.py

@@ -35,6 +35,7 @@ async def update_repo(repo: Path, delivery: str, name: str):
         raise web.HTTPServerError(
             reason=f'{delivery}: Checkout for {name} does not exist')
 
+    log.info('%s: Running git pull for %s at %s', delivery, name, repo)
     proc = await asyncio.create_subprocess_exec('git', 'pull', cwd=repo)
     try:
         await asyncio.wait_for(proc.wait(), timeout=60)
@@ -117,14 +118,24 @@ async def github_webhook(request: web.Request):
     if repository != repo:
         raise web.HTTPBadRequest(reason=f'{delivery}: incorrect repository')
 
+    # Ping event
+    # https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#ping
     if event == 'ping':
         log.info('%s: Ping %s: %s', delivery, data['hook_id'], data['zen'])
         return web.Response(status=200)
 
+    # Only allow push events otherwise
+    # https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#push
     if event != 'push':
         log.info('%s: Ignoring webhook for unused event %s', delivery, event)
         return web.Response(status=200)
 
+    ref = data.get('ref', '')
+    if ref != 'refs/heads/gh-pages':
+        log.info('%s: Ignoring push event on branch %s other than gh-pages',
+                 delivery, ref)
+        return web.Response(status=200)
+
     checkout = Path(os.environ.get('SITE_DIR', 'sites'), repository)
     await update_repo(checkout, delivery, f'{organization}/{repository}')