release: merge back stable branch into default

docs/integrations/jenkins.rst

@@ -0,0 +1,113 b''
+.. _integrations-jenkins:
+
+Jenkins integration
+===================
+
+.. important::
+
+    Jenkins integration is only available in |RCEE|.
+
+
+
+Below are few examples how to use dedicated Jenkins integrations with |RCEE|.
+
+
+
+Configure Jenkins to check each commit after push
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+In order to configure Jenkins to trigger a build on a project after each push we
+need to create a project that will allow triggering a build from external sources.
+
+In Jenkins, check `Trigger builds remotely (e.g., from scripts)` option. This gives
+now ability to trigger builds using an URL.
+
+.. image:: ../images/jenkins-build-with-parameters.png
+
+We also need to specify the parameters we're going to build the project with.
+In this example we'll use build with 3 parameters `COMMIT_ID`, `BRANCH_HEAD` and `BRANCH`.
+In Jenkins we need to add those 3 parameters, and check an option
+`This project is parameterised`
+
+.. image:: ../images/jenkins-adding-build-parameters.png
+
+
+Our final URL that |RCEE| Jenkins integration would use could look like this:
+
+This URL will be triggered for each pushed branch, and will include the branch head commit id.
+
+https://jenkins.server.com/job/test-build-commits/buildWithParameters?token=secret&BRANCH=${branch}&BRANCH_HEAD=${branch_head}
+
+Or we can also use commit_id in this case URL will be triggered for each pushed commit in the branch, and will include the commit id.
+
+https://jenkins.server.com/job/test-build-commits/buildWithParameters?token=secret&BRANCH=${branch}&COMMIT_ID=${commit_id}
+
+
+Now we have all the required information to fetch/checkout and test our project.
+We can write an example build common in Jenkins.
+
+
+.. image:: ../images/jenkins-build-command.png
+
+
+Below is an example of the integration page we used on |RCEE| side.
+
+
+.. image:: ../images/rhodecode-jenkins-integration-settings.png
+
+
+
+Configure Jenkins to check each pull-request on creation and updates
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Jenkins integration also allows checking created pull-requests inside |RCCE|. This is
+somehow a special case compared to testing commits. The pull-requests cannot be cloned
+from the repository. Instead |RCCE| exposes different links back to CI systems which
+store information on how to obtain the pull-request code.
+
+On |RCCE| side we need to create a new integration that would use only two events:
+
+ - pullrequest created
+ - pullrequest commits updated
+
+This will trigger the builds when pull-request is firstly created, and then each time
+pull-requests is updated and commits that it stores change.
+
+
+In Jenkins, we should create at least two new build string parameters.
+We could use `PR_ID` and `SHADOW_URL`.
+Using those parameters, we can then create a customized build command to checkout a
+merged state of pull-request. And later on using rhodecode-api notify about the checks
+using the `PR_ID`.
+
+
+.. image:: ../images/jenkins-pr-build-command.png
+
+
+There's even a helper script we created to send notifications.
+Here's how the build on success could look like in Jenkins.
+
+.. code-block:: bash
+
+    # clone the ci-notify script, and save it into our $BUILD_TAG/notify directory
+    hg clone https://code.rhodecode.com/ci-notify $BUILD_TAG/notify
+
+    # execute the script. $RC_TOKEN is auth-token for API
+    # url is your rhodecode instance, repoid is repository project which PR was opened
+    # status could be "approved" or "rejected"
+    python $BUILD_TAG/notify/notify.py \
+        --token $RC_TOKEN \
+        --url https://code.server.com \
+        --repoid my-example-project \
+        --prid $PR_ID \
+        --status "approved" \
+        --message "Build Succeeded: $BUILD_URL"
+
+
+Below is also an example that we could use on |RCCE| side in the Jenkins integration settings.
+A Jenkins Trigger url that exposes all required information back to Jenkins CI server:
+
+.. code-block:: bash
+
+    http://jenkins.server.com/job/my-project-pull-request-tests/buildWithParameters?token=secret&PR_ID=${pull_request_id}&PR_TITLE=${pull_request_title}&SHADOW_URL=${pull_request_shadow_url}&PR_UID=${pull_request_commits_uid}
+

docs/release-notes/release-notes-4.12.4.rst

@@ -0,0 +1,47 b''
+|RCE| 4.12.4 |RNS|
+------------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2018-07-13
+
+
+New Features
+^^^^^^^^^^^^
+
+
+
+General
+^^^^^^^
+
+
+
+Security
+^^^^^^^^
+
+
+
+Performance
+^^^^^^^^^^^
+
+
+
+Fixes
+^^^^^
+
+- Repository: fixed problems with mercurial/git url validators.
+- User Groups: fixed audit log data on user group permissions view.
+  This caused an 500 error when editing user groups.
+- Authentication: fixed problem with displaying social auth providers in the login page.
+- Google Authentication: updated google user info api to latest version. The previous
+  endpoint was deprecated and it caused problems with Google authentication.
+- API: fixed problem with setting recursive permissions changes to repo group.
+- API: fixed problem with creation of pull request with custom reviewers rules.
+- API: fixed problem with proper diff calculation with using pull-request API.
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- Scheduled release addressing reported problems, and improving stability.

.hgtags

@@ -1,41 +1,42 b''
 1bd3e92b7e2e2d2024152b34bb88dff1db544a71 v4.0.0
 170c5398320ea6cddd50955e88d408794c21d43a v4.0.1
 c3fe200198f5aa34cf2e4066df2881a9cefe3704 v4.1.0
 7fd5c850745e2ea821fb4406af5f4bff9b0a7526 v4.1.1
 41c87da28a179953df86061d817bc35533c66dd2 v4.1.2
 baaf9f5bcea3bae0ef12ae20c8b270482e62abb6 v4.2.0
 32a70c7e56844a825f61df496ee5eaf8c3c4e189 v4.2.1
 fa695cdb411d294679ac081d595ac654e5613b03 v4.3.0
 0e4dc11b58cad833c513fe17bac39e6850edf959 v4.3.1
 8a876f48f5cb1d018b837db28ff928500cb32cfb v4.4.0
 8dd86b410b1aac086ffdfc524ef300f896af5047 v4.4.1
 d2514226abc8d3b4f6fb57765f47d1b6fb360a05 v4.4.2
 27d783325930af6dad2741476c0d0b1b7c8415c2 v4.5.0
 7f2016f352abcbdba4a19d4039c386e9629449da v4.5.1
 416fec799314c70a5c780fb28b3357b08869333a v4.5.2
 27c3b85fafc83143e6678fbc3da69e1615bcac55 v4.6.0
 5ad13deb9118c2a5243d4032d4d9cc174e5872db v4.6.1
 2be921e01fa24bb102696ada596f87464c3666f6 v4.7.0
 7198bdec29c2872c974431d55200d0398354cdb1 v4.7.1
 bd1c8d230fe741c2dfd7100a0ef39fd0774fd581 v4.7.2
 9731914f89765d9628dc4dddc84bc9402aa124c8 v4.8.0
 c5a2b7d0e4bbdebc4a62d7b624befe375207b659 v4.9.0
 d9aa3b27ac9f7e78359775c75fedf7bfece232f1 v4.9.1
 4ba4d74981cec5d6b28b158f875a2540952c2f74 v4.10.0
 0a6821cbd6b0b3c21503002f88800679fa35ab63 v4.10.1
 434ad90ec8d621f4416074b84f6e9ce03964defb v4.10.2
 68baee10e698da2724c6e0f698c03a6abb993bf2 v4.10.3
 00821d3afd1dce3f4767cc353f84a17f7d5218a1 v4.10.4
 22f6744ad8cc274311825f63f953e4dee2ea5cb9 v4.10.5
 96eb24bea2f5f9258775245e3f09f6fa0a4dda01 v4.10.6
 3121217a812c956d7dd5a5875821bd73e8002a32 v4.11.0
 fa98b454715ac5b912f39e84af54345909a2a805 v4.11.1
 3982abcfdcc229a723cebe52d3a9bcff10bba08e v4.11.2
 33195f145db9172f0a8f1487e09207178a6ab065 v4.11.3
 194c74f33e32bbae6fc4d71ec5a999cff3c13605 v4.11.4
 8fbd8b0c3ddc2fa4ac9e4ca16942a03eb593df2d v4.11.5
 f0609aa5d5d05a1ca2f97c3995542236131c9d8a v4.11.6
 b5b30547d90d2e088472a70c84878f429ffbf40d v4.12.0
 9072253aa8894d20c00b4a43dc61c2168c1eff94 v4.12.1
 6a517543ea9ef9987d74371bd2a315eb0b232dc9 v4.12.2
 7fc0731b024c3114be87865eda7ab621cc957e32 v4.12.3
+6d531c0b068c6eda62dddceedc9f845ecb6feb6f v4.12.4

docs/integrations/ci.rst

@@ -1,97 +1,100 b''
 .. _integrations-ci:
 
 CI Server integration
 =====================
 
 
 RhodeCode :ref:`integrations-webhook` integration is a powerfull tool to allow
 interaction with systems like Jenkin, Bamboo, TeamCity, CircleCi or any other
 CI server that allows triggering a build using HTTP call.
 
 Below are few examples on how to use :ref:`integrations-webhook` to trigger
 a CI build.
 
 
 General Webhook
 +++++++++++++++
 
 :ref:`integrations-webhook` allows sending a JSON payload information to specified
-url with GET or POST methods. There are several variables that could be used
+custom URL with GET or POST methods. There are several variables that could be used
 in the URL greatly extending the flexibility of this type of integration.
 
 Most of the modern CI systems such as Jenkins, TeamCity, Bamboo or CircleCi
 allows triggering builds via GET or POST calls.
 
 :ref:`integrations-webhook` can be either specified per each repository or
 globally, if your CI maps directly to all your projects a global
 :ref:`integrations-webhook` integration can be created and will trigger builds
 for each change in projects. If only some projects allow triggering builds a
 global integration will also work because mostly a CI system will ignore a
 call for unspecified builds.
 
 
 .. note::
 
     A quick note on security. It's recommended to allow IP restrictions
     to only allow RhodeCode server to trigger builds. If you need to
     specify username and password this could be done by embedding it into a
     trigger URL, e.g. `http://user:[e-mail]/job/${project_id}`
 
 
 If users require to provide any custom parameters, they can be stored for each
 project inside the :ref:`repo-xtra`. For example to migrate a current job that
 has a numeric build id, storing this as `jenkins_build_id` key extra field
 the url would look like that::
 
     http://server/job/${extra:jenkins_build_id}/
 
 
 .. note::
 
     Please note that some variables will result in multiple calls.
     e.g. for |HG| specifying `${branch}` will trigger as many builds as how
-    many branches the suer actually pushed. Same applies to `${commit_id}`
+    many branches the user actually pushed. Same applies to `${commit_id}`
     This will trigger many builds if many commits are pushed. This allows
     triggering individual builds for each pushed commit.
 
 
 Jenkins
 +++++++
 
 To use Jenkins CI with RhodeCode, a Jenkins Build with Parameters should be used.
 Plugin details are available here: https://wiki.jenkins.io/display/JENKINS/Build+With+Parameters+Plugin
 
 If the plugin is configured, RhodeCode can trigger builds automatically by
 calling such example url provided in :ref:`integrations-webhook` integration::
 
     http://server/job/${project_id}/build-branch-${branch}/buildWithParameters?token=TOKEN&PARAMETER=value&PARAMETER2=value2
 
+The |RCEE| includes a custom :ref:`integrations-jenkins` integration. That allows using some
+of Jenkins added security features. Please check also the above link for more examples.
+
 
 Team City
 +++++++++
 
 To use TeamCity CI it's enough to call the API and provide a buildId.
 Example url after configuring :ref:`repo-xtra` would look like that::
 
     http://teacmtiyserver/viewType.html?buildTypeId=${extra:tc_build_id}
 
 
 Each project can have many build configurations.
 buildTypeId which is a unique ID for each build configuration (job).
 
 
 CircleCi
 ++++++++
 
 To use CircleCi, a POST call needs to be triggered. Example build url would
 look like this::
 
     http://cicleCiServer/project/${repo_type}/${username}/${repo_id}/tree/${branch}
 
 
 Circle Ci expects format of::
 
     POST: /project/:vcs-type/:username/:project/tree/:branch
 
 
 CircleCi API documentation can be found here: https://circleci.com/docs/api/v1-reference/

docs/integrations/integrations.rst

@@ -1,55 +1,57 b''
 .. _integrations:
 
 Integrations
 ------------
 
 Rhodecode supports integrations with external services for various events,
 such as commit pushes and pull requests. Multiple integrations of the same type
 can be added at the same time; this is useful for posting different events to
 different Slack channels, for example.
 
 Supported integrations
 ^^^^^^^^^^^^^^^^^^^^^^
 
 ============================    ============    =====================================
 Type/Name                       |RC| Edition    Description
 ============================    ============    =====================================
 :ref:`integrations-slack`       |RCCEshort|     https://slack.com/
 :ref:`integrations-hipchat`     |RCCEshort|     https://www.hipchat.com/
 :ref:`integrations-webhook`     |RCCEshort|     POST events as `json` to a custom url
 :ref:`integrations-ci`          |RCCEshort|     Trigger Builds for Common CI Systems
 :ref:`integrations-email`       |RCCEshort|     Send repo push commits by email
-:ref:`integrations-redmine`     |RCEEshort|     Close/Resolve/Reference redmine issues
+:ref:`integrations-jenkins`     |RCEEshort|     Trigger Builds for Jenkins CI System
+:ref:`integrations-redmine`     |RCEEshort|     Close/Resolve/Reference Redmine issues
 :ref:`integrations-jira`        |RCEEshort|     Close/Resolve/Reference JIRA issues
 ============================    ============    =====================================
 
 .. _creating-integrations:
 
 Creating an Integration
 ^^^^^^^^^^^^^^^^^^^^^^^
 
 Integrations can be added globally via the admin UI:
 
 :menuselection:`Admin --> Integrations`
 
 or per repository in each repository's settings:
 
 :menuselection:`Admin --> Repositories --> Edit --> Integrations`
 
 To create an integration, select the type from the list in the *Create New
 Integration* section.
 
 The *Current Integrations* section shows existing integrations that have been
 created along with their type (eg. Slack) and enabled status.
 
 See pages specific to each type of integration for more instructions:
 
 .. toctree::
 
    slack
    hipchat
    redmine
    jira
    webhook
    email
    ci
+   jenkins

docs/release-notes/release-notes.rst

@@ -1,118 +1,119 b''
 .. _rhodecode-release-notes-ref:
 
 Release Notes
 =============
 
 |RCE| 4.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.12.4.rst
    release-notes-4.12.3.rst
    release-notes-4.12.2.rst
    release-notes-4.12.1.rst
    release-notes-4.12.0.rst
    release-notes-4.11.6.rst
    release-notes-4.11.5.rst
    release-notes-4.11.4.rst
    release-notes-4.11.3.rst
    release-notes-4.11.2.rst
    release-notes-4.11.1.rst
    release-notes-4.11.0.rst
    release-notes-4.10.6.rst
    release-notes-4.10.5.rst
    release-notes-4.10.4.rst
    release-notes-4.10.3.rst
    release-notes-4.10.2.rst
    release-notes-4.10.1.rst
    release-notes-4.10.0.rst
    release-notes-4.9.1.rst
    release-notes-4.9.0.rst
    release-notes-4.8.0.rst
    release-notes-4.7.2.rst
    release-notes-4.7.1.rst
    release-notes-4.7.0.rst
    release-notes-4.6.1.rst
    release-notes-4.6.0.rst
    release-notes-4.5.2.rst
    release-notes-4.5.1.rst
    release-notes-4.5.0.rst
    release-notes-4.4.2.rst
    release-notes-4.4.1.rst
    release-notes-4.4.0.rst
    release-notes-4.3.1.rst
    release-notes-4.3.0.rst
    release-notes-4.2.1.rst
    release-notes-4.2.0.rst
    release-notes-4.1.2.rst
    release-notes-4.1.1.rst
    release-notes-4.1.0.rst
    release-notes-4.0.1.rst
    release-notes-4.0.0.rst
 
 |RCE| 3.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-3.8.4.rst
    release-notes-3.8.3.rst
    release-notes-3.8.2.rst
    release-notes-3.8.1.rst
    release-notes-3.8.0.rst
    release-notes-3.7.1.rst
    release-notes-3.7.0.rst
    release-notes-3.6.1.rst
    release-notes-3.6.0.rst
    release-notes-3.5.2.rst
    release-notes-3.5.1.rst
    release-notes-3.5.0.rst
    release-notes-3.4.1.rst
    release-notes-3.4.0.rst
    release-notes-3.3.4.rst
    release-notes-3.3.3.rst
    release-notes-3.3.2.rst
    release-notes-3.3.1.rst
    release-notes-3.3.0.rst
    release-notes-3.2.3.rst
    release-notes-3.2.2.rst
    release-notes-3.2.1.rst
    release-notes-3.2.0.rst
    release-notes-3.1.1.rst
    release-notes-3.1.0.rst
    release-notes-3.0.2.rst
    release-notes-3.0.1.rst
    release-notes-3.0.0.rst
 
 |RCE| 2.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-2.2.8.rst
    release-notes-2.2.7.rst
    release-notes-2.2.6.rst
    release-notes-2.2.5.rst
    release-notes-2.2.4.rst
    release-notes-2.2.3.rst
    release-notes-2.2.2.rst
    release-notes-2.2.1.rst
    release-notes-2.2.0.rst
    release-notes-2.1.0.rst
    release-notes-2.0.2.rst
    release-notes-2.0.1.rst
    release-notes-2.0.0.rst
 
 |RCE| 1.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-1.7.2.rst
    release-notes-1.7.1.rst
    release-notes-1.7.0.rst
    release-notes-1.6.0.rst

rhodecode/integrations/types/base.py

@@ -1,311 +1,322 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import colander
 import string
 import collections
 import logging
 
 from mako import exceptions
 
 from rhodecode.translation import _
 
 
 log = logging.getLogger(__name__)
 
 
 class IntegrationTypeBase(object):
     """ Base class for IntegrationType plugins """
     is_dummy = False
     description = ''
 
     @classmethod
     def icon(cls):
         return '''
         <?xml version="1.0" encoding="UTF-8" standalone="no"?>
         <svg
            xmlns:dc="http://purl.org/dc/elements/1.1/"
            xmlns:cc="http://creativecommons.org/ns#"
            xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
            xmlns:svg="http://www.w3.org/2000/svg"
            xmlns="http://www.w3.org/2000/svg"
            xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
            xmlns:inkscape="http://setwww.inkscape.org/namespaces/inkscape"
            viewBox="0 -256 1792 1792"
            id="svg3025"
            version="1.1"
            inkscape:version="0.48.3.1 r9886"
            width="100%"
            height="100%"
            sodipodi:docname="cog_font_awesome.svg">
           <metadata
              id="metadata3035">
             <rdf:RDF>
               <cc:Work
                  rdf:about="">
                 <dc:format>image/svg+xml</dc:format>
                 <dc:type
                    rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
               </cc:Work>
             </rdf:RDF>
           </metadata>
           <defs
              id="defs3033" />
           <sodipodi:namedview
              pagecolor="#ffffff"
              bordercolor="#666666"
              borderopacity="1"
              objecttolerance="10"
              gridtolerance="10"
              guidetolerance="10"
              inkscape:pageopacity="0"
              inkscape:pageshadow="2"
              inkscape:window-width="640"
              inkscape:window-height="480"
              id="namedview3031"
              showgrid="false"
              inkscape:zoom="0.13169643"
              inkscape:cx="896"
              inkscape:cy="896"
              inkscape:window-x="0"
              inkscape:window-y="25"
              inkscape:window-maximized="0"
              inkscape:current-layer="svg3025" />
           <g
              transform="matrix(1,0,0,-1,121.49153,1285.4237)"
              id="g3027">
             <path
                d="m 1024,640 q 0,106 -75,181 -75,75 -181,75 -106,0 -181,-75 -75,-75 -75,-181 0,-106 75,-181 75,-75 181,-75 106,0 181,75 75,75 75,181 z m 512,109 V 527 q 0,-12 -8,-23 -8,-11 -20,-13 l -185,-28 q -19,-54 -39,-91 35,-50 107,-138 10,-12 10,-25 0,-13 -9,-23 -27,-37 -99,-108 -72,-71 -94,-71 -12,0 -26,9 l -138,108 q -44,-23 -91,-38 -16,-136 -29,-186 -7,-28 -36,-28 H 657 q -14,0 -24.5,8.5 Q 622,-111 621,-98 L 593,86 q -49,16 -90,37 L 362,16 Q 352,7 337,7 323,7 312,18 186,132 147,186 q -7,10 -7,23 0,12 8,23 15,21 51,66.5 36,45.5 54,70.5 -27,50 -41,99 L 29,495 Q 16,497 8,507.5 0,518 0,531 v 222 q 0,12 8,23 8,11 19,13 l 186,28 q 14,46 39,92 -40,57 -107,138 -10,12 -10,24 0,10 9,23 26,36 98.5,107.5 72.5,71.5 94.5,71.5 13,0 26,-10 l 138,-107 q 44,23 91,38 16,136 29,186 7,28 36,28 h 222 q 14,0 24.5,-8.5 Q 914,1391 915,1378 l 28,-184 q 49,-16 90,-37 l 142,107 q 9,9 24,9 13,0 25,-10 129,-119 165,-170 7,-8 7,-22 0,-12 -8,-23 -15,-21 -51,-66.5 -36,-45.5 -54,-70.5 26,-50 41,-98 l 183,-28 q 13,-2 21,-12.5 8,-10.5 8,-23.5 z"
                id="path3029"
                inkscape:connector-curvature="0"
                style="fill:currentColor" />
           </g>
         </svg>
         '''
 
     def __init__(self, settings):
         """
         :param settings: dict of settings to be used for the integration
         """
         self.settings = settings
 
     def settings_schema(self):
         """
         A colander schema of settings for the integration type
         """
         return colander.Schema()
 
 
 class EEIntegration(IntegrationTypeBase):
     description = 'Integration available in RhodeCode EE edition.'
     is_dummy = True
 
     def __init__(self, name, key, settings=None):
         self.display_name = name
         self.key = key
         super(EEIntegration, self).__init__(settings)
 
 
 # Helpers #
+# updating this required to update the `common_vars` as well.
 WEBHOOK_URL_VARS = [
     ('event_name', 'Unique name of the event type, e.g pullrequest-update'),
     ('repo_name', 'Full name of the repository'),
     ('repo_type', 'VCS type of repository'),
     ('repo_id', 'Unique id of repository'),
     ('repo_url', 'Repository url'),
     # extra repo fields
     ('extra:<extra_key_name>', 'Extra repo variables, read from its settings.'),
 
     # special attrs below that we handle, using multi-call
-    ('branch', 'Name of each brach submitted, if any.'),
-    ('commit_id', 'Id of each commit submitted, if any.'),
+    ('branch', 'Name of each branch submitted, if any.'),
+    ('branch_head', 'Head ID of pushed branch (full sha of last commit), if any.'),
+    ('commit_id', 'ID (full sha) of each commit submitted, if any.'),
 
     # pr events vars
     ('pull_request_id', 'Unique ID of the pull request.'),
     ('pull_request_title', 'Title of the pull request.'),
     ('pull_request_url', 'Pull request url.'),
     ('pull_request_shadow_url', 'Pull request shadow repo clone url.'),
     ('pull_request_commits_uid', 'Calculated UID of all commits inside the PR. '
                                  'Changes after PR update'),
 
     # user who triggers the call
     ('username', 'User who triggered the call.'),
     ('user_id', 'User id who triggered the call.'),
 ]
 
 # common vars for url template used for CI plugins. Shared with webhook
 CI_URL_VARS = WEBHOOK_URL_VARS
 
 
 class CommitParsingDataHandler(object):
 
     def aggregate_branch_data(self, branches, commits):
         branch_data = collections.OrderedDict()
         for obj in branches:
             branch_data[obj['name']] = obj
 
         branches_commits = collections.OrderedDict()
         for commit in commits:
             if commit.get('git_ref_change'):
                 # special case for GIT that allows creating tags,
                 # deleting branches without associated commit
                 continue
             commit_branch = commit['branch']
 
             if commit_branch not in branches_commits:
                 _branch = branch_data[commit_branch] \
                     if commit_branch else commit_branch
                 branch_commits = {'branch': _branch,
+                                  'branch_head': '',
                                   'commits': []}
                 branches_commits[commit_branch] = branch_commits
 
             branch_commits = branches_commits[commit_branch]
             branch_commits['commits'].append(commit)
+            branch_commits['branch_head'] = commit['raw_id']
         return branches_commits
 
 
 class WebhookDataHandler(CommitParsingDataHandler):
     name = 'webhook'
 
     def __init__(self, template_url, headers):
         self.template_url = template_url
         self.headers = headers
 
     def get_base_parsed_template(self, data):
         """
         initially parses the passed in template with some common variables
         available on ALL calls
         """
         # note: make sure to update the `WEBHOOK_URL_VARS` if this changes
         common_vars = {
             'repo_name': data['repo']['repo_name'],
             'repo_type': data['repo']['repo_type'],
             'repo_id': data['repo']['repo_id'],
             'repo_url': data['repo']['url'],
             'username': data['actor']['username'],
             'user_id': data['actor']['user_id'],
             'event_name': data['name']
         }
 
         extra_vars = {}
         for extra_key, extra_val in data['repo']['extra_fields'].items():
             extra_vars['extra__{}'.format(extra_key)] = extra_val
         common_vars.update(extra_vars)
 
         template_url = self.template_url.replace('${extra:', '${extra__')
         return string.Template(template_url).safe_substitute(**common_vars)
 
     def repo_push_event_handler(self, event, data):
         url = self.get_base_parsed_template(data)
         url_cals = []
 
         branches_commits = self.aggregate_branch_data(
             data['push']['branches'], data['push']['commits'])
-        if '${branch}' in url:
+        if '${branch}' in url or '${branch_head}' in url:
             # call it multiple times, for each branch if used in variables
             for branch, commit_ids in branches_commits.items():
                 branch_url = string.Template(url).safe_substitute(branch=branch)
+
+                if '${branch_head}' in branch_url:
+                    # last commit in the aggregate is the head of the branch
+                    branch_head = commit_ids['branch_head']
+                    branch_url = string.Template(branch_url).safe_substitute(
+                        branch_head=branch_head)
+
                 # call further down for each commit if used
                 if '${commit_id}' in branch_url:
                     for commit_data in commit_ids['commits']:
                         commit_id = commit_data['raw_id']
                         commit_url = string.Template(branch_url).safe_substitute(
                             commit_id=commit_id)
                         # register per-commit call
                         log.debug(
                             'register %s call(%s) to url %s',
                             self.name, event, commit_url)
                         url_cals.append(
                             (commit_url, self.headers, data))
 
                 else:
                     # register per-branch call
                     log.debug(
                         'register %s call(%s) to url %s',
                         self.name, event, branch_url)
                     url_cals.append(
                         (branch_url, self.headers, data))
 
         else:
             log.debug(
                 'register %s call(%s) to url %s', self.name, event, url)
             url_cals.append((url, self.headers, data))
 
         return url_cals
 
     def repo_create_event_handler(self, event, data):
         url = self.get_base_parsed_template(data)
         log.debug(
             'register %s call(%s) to url %s', self.name, event, url)
         return [(url, self.headers, data)]
 
     def pull_request_event_handler(self, event, data):
         url = self.get_base_parsed_template(data)
         log.debug(
             'register %s call(%s) to url %s', self.name, event, url)
         url = string.Template(url).safe_substitute(
             pull_request_id=data['pullrequest']['pull_request_id'],
             pull_request_title=data['pullrequest']['title'],
             pull_request_url=data['pullrequest']['url'],
             pull_request_shadow_url=data['pullrequest']['shadow_url'],
             pull_request_commits_uid=data['pullrequest']['commits_uid'],
         )
         return [(url, self.headers, data)]
 
     def __call__(self, event, data):
         from rhodecode import events
 
         if isinstance(event, events.RepoPushEvent):
             return self.repo_push_event_handler(event, data)
         elif isinstance(event, events.RepoCreateEvent):
             return self.repo_create_event_handler(event, data)
         elif isinstance(event, events.PullRequestEvent):
             return self.pull_request_event_handler(event, data)
         else:
             raise ValueError(
                 'event type `%s` not in supported list: %s' % (
                     event.__class__, events))
 
 
 def get_auth(settings):
     from requests.auth import HTTPBasicAuth
     username = settings.get('username')
     password = settings.get('password')
     if username and password:
         return HTTPBasicAuth(username, password)
     return None
 
 
 def get_web_token(settings):
     return settings['secret_token']
 
 
 def get_url_vars(url_vars):
     return '\n'.join(
         '{} - {}'.format('${' + key + '}', explanation)
         for key, explanation in url_vars)
 
 
 def render_with_traceback(template, *args, **kwargs):
     try:
         return template.render(*args, **kwargs)
     except Exception:
         log.error(exceptions.text_error_template().render())
         raise