[JENKINS-70548] Allow GitHub Webhooks to be created by users with custom roles - #375

@lanwen Any chance of getting this reviewed and (hopefully) merged?

@KostyaSha would you mind taking a look at this? This feature would be very convenient in my team's permission structure.

We can try, in case of issues could be reverted back

@KostyaSha Any ETA on when it could be tried? This is a major factor for our effort to ensure principal of least privilege.

It would be better to move it as option. Admin check was added to identify that returned object will be able to manage hooks. Now it can return connection that will lead to errors. Also AFAIR it was impossible to make an github API check whether user can manage hook and i sent request to github support. AFAIR permissions were listed in http headers and github-api library didn't support it (now it already supports afair).

@KostyaSha I'm not certain how you'd want this to be implemented.

For instance, it doesn't look like the library being used for the GitHub API supports custom roles (would return UNKNOWN): https://github.com/hub4j/github-api/blob/51b3a06fe364a9667d8c4e0b64abc780cff8d371/src/main/java/org/kohsuke/github/GHPermissionType.java#L9C1-L20C17

Are you saying that the admin check should still happen after the webhook permission is confirmed and simply not cause failure?

I can't imagine this will ever be reviewed, so closing.