# Bug OP-4594 - GitHub webhook failure

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-4594

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 7.4.4 |
| Observed in versions |  |
| Sprint | 7.4.4 |
| Backlog bucket |  |
| Bug found in version (deprecated) |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

Since upgrade to 7.4.3 the [OpenProject Github Integration Plugin](https://github.com/finnlabs/openproject-github_integration) has stopped functioning (we are using Docker image based installation).

## Steps to reproduce the bug

\- The webhooks plugin and the OpenProject Github Integration Plugin are installed.

\- A “GitHub” role with *View work packages* and *Add notes* work package tracking permissions is setup and a “GitHub Bot” user is added on a project with the created GitHub role.

\- An API key is generated for the “GitHub Bot” user and then used to setup a webhook on a GitHub repository for *Pull requests* and *Issue comments* events, where the webhook request content type is `application/json` and the payload URL is in the following format: `https://<openproject_instance>/webhooks/github?key=<github_bot_api_key>`  
\- A PR is created or commented for this repo on GitHub with a URL of a work package in the OpenProject instance.

## Actual behavior

\- No message by GitHub Bot is posted on the work package in the OpenProject instance.

\- GitHub webhook delivieries show a “500 Internal server error” for the requests.  
\- Error I see in the logs when the webhook is called:

    App 1642 stdout: Can't verify CSRF token authenticity.
    App 1642 stdout:
    App 1642 stdout: RuntimeError (Github action handle_hook for event pull_request not supported.):
    App 1642 stdout:
    App 1642 stdout: lib/open_project/notifications.rb:57:in `block in subscribe'
    App 1642 stdout: lib/open_project/notifications.rb:75:in `send'
    App 1642 stdout: app/middleware/reset_current_user.rb:47:in `call'
    App 6445 stdout:

## Expected behavior

\- Comment is posted on the work package on the OpenProject instance informing about the opened/closed pull request.

## Additional information

I have tested these Docker images: 7.4.3, 7.4.1, 7.4.0.

In 7.4.0 it works if the webhook payload is wrapped in `{"webhook": {...}}` and it stops working in 7.4.1 when the payload is no longer wrapped. So my guess would be that it stopped working after changes in [deee0ce](https://github.com/finnlabs/openproject-github_integration/commit/deee0cef06321361a7f15981aab40878074cc2ce).