AWS CodePipeline GitHub webhook can not be registered with GitHub if repo is an organisation repository

Question

When I set up the hook using the console it works, but when I try to do it using cloudformation it never works. It does not even work if I use the AWS CLI version:

aws codepipeline register-webhook-with-third-party --webhook-name AppPipelineWebhook-aOnbonyFrNZu

This is how my webhook looks like (output from "aws codepipeline list-webhooks"):

    {
        "webhooks": [
            {
                "definition": {
                    "name": "AppPipelineWebhook-aOnbonyFrNZu",
                    "targetPipeline": "ftp-proxy-cf",
                    "targetAction": "GitHubAction",
                    "filters": [
                        {
                            "jsonPath": "$.ref",
                            "matchEquals": "refs/heads/{Branch}"
                        }
                    ],
                    "authentication": "GITHUB_HMAC",
                    "authenticationConfiguration": {
                        "SecretToken": "<REDACTED>"
                    }
                },
                "url": "https://eu-west-1.webhooks.aws/trigger?t=eyJ<ALSO REDACTED>F9&v=1",
                "arn": "arn:aws:codepipeline:eu-west-1:<our account ID>:webhook:AppPipelineWebhook-aOnbonyFrNZu",
                "tags": []
            }
        ]
    }

The error I get is:

An error occurred (ValidationException) when calling the RegisterWebhookWithThirdParty operation: Webhook could not be registered with GitHub. Error cause: Not found [StatusCode: 404, Body: {"message":"Not Found","documentation_url":"https://developer.github.com/v3/repos/hooks/#create-a-hook"}]

These are the two relevant sections from my cloudformation file:

Resources:
  AppPipelineWebhook:
    Type: AWS::CodePipeline::Webhook
    Properties:
      Authentication: GITHUB_HMAC
      AuthenticationConfiguration:
        SecretToken: '{{resolve:secretsmanager:my/secretpath/github:SecretString:token}}'
      Filters:
        - JsonPath: $.ref
          MatchEquals: 'refs/heads/{Branch}'
      TargetPipeline: !Ref CodePipeline
      TargetAction: GitHubAction
      TargetPipelineVersion: !GetAtt CodePipeline.Version
      # RegisterWithThirdParty: true

  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties: 
      Name: 
        Ref: PipelineName
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      Stages:
        - Name: Source
          Actions: 
          - Name: GitHubAction
            ActionTypeId:
              Category: Source 
              Owner: ThirdParty 
              Version: 1 
              Provider: GitHub
            OutputArtifacts:
              - Name: SourceOutput
            Configuration:
              Owner: myorganisationnameongithub
              Repo: ftp-proxy
              Branch: master
              OAuthToken: '{{resolve:secretsmanager:my/secretpath/github:SecretString:token}}'
              PollForSourceChanges: false

It can poll changes all right. So if I manually order an execution of the GitHubAction stage from the AWS Console, the latest commits are downloaded. And if I set PollForSourceChanges: true, that kind of polling also works, but alas not the webhook workflow (because the hook can not be registered with GitHub)

Answer 1

The error is observed due to (2) possible causes:

1. The Personal Access Token (PAT) is not configured to have the following GitHub scopes: admin:repo_hook and admin:org_hook 1

   You can verify these permissions under 'User' (Top RIght) > 'Settings' > 'Developer Settings' > 'Personal Access Tokens'

2. 'Owner' and/or 'Repository' name are incorrect in the CloudFormation template:

   For the Pipeline Configuration in CloudFormation, make sure 'GitHubOwner' is the 'Organization name' and repository name is just the repo name and does not have a "org/repo_name" in it, e.g. in your case:

Example:

Configuration:
    Owner: !Ref GitHubOwner                <========== Github org name
    Repo: !Ref RepositoryName                
    Branch: !Ref BranchName                
    OAuthToken: !Ref GitHubOAuthToken       <========== <Personal Access Token>