git/gitlab: enable SSL verification for project webhooks

pkg/git/gitlab/gitlab.go

@@ -13,8 +13,6 @@ type Client struct {
 }
 
 func (c Client) CreateWebHook(ctx context.Context, repoOwner, repoName, payloadURL, webhookSecret string) error {
-	t := true
-	f := false
 	glabCli, err := gitlab.NewClient(c.PersonalAccessToken,
 		gitlab.WithBaseURL(c.BaseURL),
 		gitlab.WithRequestOptions(gitlab.WithContext(ctx)))
@@ -35,16 +33,24 @@ func (c Client) CreateWebHook(ctx context.Context, repoOwner, repoName, payloadU
 		}
 	}
 
-	webhook := &gitlab.AddProjectHookOptions{
-		EnableSSLVerification: &f,
-		PushEvents:            &t,
-		Token:                 &webhookSecret,
-		URL:                   &payloadURL,
-	}
+	webhook := projectHookOpts(payloadURL, webhookSecret)
 
 	_, _, err = glabCli.Projects.AddProjectHook(projectPath, webhook)
 	if err != nil {
 		return fmt.Errorf("cannot create gitlab webhook: %w", err)
 	}
 	return nil
 }
+
+// projectHookOpts returns REST options used by CreateWebHook with TLS
+// certificate verification enabled for the payload URL (GitLab default).
+func projectHookOpts(payloadURL, webhookSecret string) *gitlab.AddProjectHookOptions {
+	enableSSLVerify := true
+	pushEvents := true
+	return &gitlab.AddProjectHookOptions{
+		EnableSSLVerification: &enableSSLVerify,
+		PushEvents:            &pushEvents,
+		Token:                 &webhookSecret,
+		URL:                   &payloadURL,
+	}
+}

pkg/git/gitlab/project_hook_opts_test.go

@@ -0,0 +1,32 @@
+package gitlab
+
+import "testing"
+
+func TestProjectHookOpts_SSLVerificationEnabled(t *testing.T) {
+	opts := projectHookOpts("https://example.invalid/hook", "tok")
+	if opts == nil {
+		t.Fatal("nil options")
+	}
+	if opts.EnableSSLVerification == nil {
+		t.Fatal("EnableSSLVerification is nil")
+	}
+	if !*opts.EnableSSLVerification {
+		t.Fatal("EnableSSLVerification must be true")
+	}
+	if opts.PushEvents == nil || !*opts.PushEvents {
+		t.Fatal("PushEvents must be true for compatibility with prior behavior")
+	}
+	if opts.URL == nil || *opts.URL != "https://example.invalid/hook" {
+		t.Fatalf("got URL %#v", strPtr(opts.URL))
+	}
+	if opts.Token == nil || *opts.Token != "tok" {
+		t.Fatalf("got Token %#v", strPtr(opts.Token))
+	}
+}
+
+func strPtr(p *string) string {
+	if p == nil {
+		return "<nil>"
+	}
+	return *p
+}