Customs scripts ignore X-NetBox-Branch header when triggered via API

[RedLine89]

Plugin Version

0.8.1

NetBox Version

4.4.2

Python Version

3.12.3

Steps to Reproduce

1. Add script that creates a single Site and a new device in that site.
2. Create a new branch and let it get provisioned. Grab schema_id value.
3. Issue POST to trigger custom script attaching X-NetBox-Branch header with schema_id from the previous step.

curl --location 'http://localhost:8000/api/extras/scripts/67/' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'X-NetBox-Branch: vdv9yxmd' \
--header 'Authorization: Token 2345bj5hkj...etc' \
--data '{
  "data": {
    "device_name": "router_1"
  },
  "commit": true
}'

Expected Behavior

When scrip is executed, it will apply changes to the branch specified in the X-NetBox-Branch header. Same as it behaves when triggered via UI.

Observed Behavior

Changes applied to the master branch and not the the branch specified in X-NetBox-Branch header.
I am not sure if it supposed to be supported, but wanted to raise this and have some input on it.

My limited knowledge interpretation of the problem.

It appears that problem is that copy_safe_request() only copies a whitelist of HTTP headers, and X-NetBox-Branch is not included in that whitelist.

The flow I managed to piece together:

• API request arrives with X-NetBox-Branch: vdv9yxmd header
• Django converts it to request.META['HTTP_X_NETBOX_BRANCH']
• ScriptJob.enqueue() calls copy_safe_request(request)
• copy_safe_request() only copies headers in HTTP_REQUEST_META_SAFE_COPY
• Since HTTP_X_NETBOX_BRANCH is not in that list, it gets dropped
• The background job receives a request without the branch header
• get_active_branch() returns None because it can't find the header
• Script executes on the main branch instead

[jeremystretch]

Thanks for the report. I've opened netbox-community/netbox#21468 to capture this as it will require a change in NetBox core rather than the plugin. Marking this as blocked for now.