Idea is that we can setup salt-api to receive hook call from GitHub, and configured run stat.sls
only if the request HMAC signature matche is successful.
Unfortunately most documentation says to deactivate salt-api hooks authentication (i.e. webhook_disable_auth: True
) which is not a good idea.
This Gist is about finding a way to declare which state to run based on data GitHub sends on push hook. But ONLY if the request is valid.
Skeleton defines desired logic, see reactor_github_push.py below.