feat(api,cli): check GitHub App webhook event subscriptions#324
Merged
Zach Dunn (zachdunn) merged 1 commit intoJul 21, 2026
Merged
Conversation
The App can ship with a green ping while issues/pull_request are never ticked under Settings -> Permissions & events -> Subscribe to events, silently disabling webhook auto-promotion and title-cache invalidation. Adds GET /v1/:workspace/github/health (App JWT -> GET /app -> compare events) and `uploads github doctor` to surface that gap instead of requiring someone to notice via /app/hook/deliveries.
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (2)
🚫 Excluded labels (none allowed) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-api | 6fce253 | Commit Preview URL Branch Preview URL |
Jul 21 2026, 10:38 AM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-auth | 6fce253 | Commit Preview URL Branch Preview URL |
Jul 21 2026, 10:38 AM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-web | 6fce253 | Commit Preview URL Branch Preview URL |
Jul 21 2026, 10:38 AM |
This was referenced Jul 21, 2026
Zach Dunn (zachdunn)
added a commit
that referenced
this pull request
Jul 21, 2026
…eal (#334) github-app.astro accreted separate notes across #324/#332 for the doctor health-check and the recommended issue_comment subscription; restructure it into one coherent page: permissions vs events (required vs recommended, doctor as the verification tool), a new repo-bindings section (first-claim- wins, unlink, admin reassign, and reassurance that other workspaces can't post to your repo), a dedicated self-healing-comments section, and a short newcomer orientation for readers arriving from the bot comment's docs link who have never seen the CLI. Both agent skills covered stage-as-you-go branch staging in #322 but predate unlink, doctor, and the not_authorized cross-tenant decline (#325/#327): add the remedy path (link --status, then unlink or ask an operator), doctor as the health check, what not_authorized means (no gh fallback), and that the bot comment self-heals so agents don't panic-repost when it briefly disappears.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
issues/pull_requestare never ticked under Settings → Permissions & events → Subscribe to events — silently disabling webhook auto-promotion (feat(api): GitHub webhooks for phase-1 title-cache invalidation (phase 2 PR A) #288) and title-cache invalidation, with nothing that surfaces the gap.GET /v1/:workspace/github/health: uses the App JWT to callGET /app(which returns the App's subscribedevents), and compares against the required list (issues,pull_request— the eventshandleWebhookactually reads).uploads github doctor, a CLI check against that endpoint, reporting missing subscriptions and a pointer to Settings → Permissions & events → Subscribe to events.apps/web/src/pages/docs/github-app.astro, Permissions section).Where the check lives
apps/api/src/github-app.ts(appEventSubscriptions,REQUIRED_WEBHOOK_EVENTS), wired intoapps/api/src/routes/github-health.ts, mounted at/v1/:workspace/github/health(same auth pattern as/github/link).packages/uploads/src/client.ts(githubHealth()),packages/uploads/src/commands.ts(runGithubgains adoctorsubaction),packages/uploads/src/cli-catalog.ts(help catalog entry).Required events enforced
issues,pull_request— the two event typeshandleWebhook(apps/api/src/github-webhook.ts) reads for title invalidation and pull-request auto-promotion. (installation/installation_repositories/pingare always sent by GitHub regardless of subscription, so they're not part of the required list.)Test plan
pnpm test— 1945 tests pass across the monorepo (apps/api, packages/uploads, apps/web, apps/auth, apps/mcp, packages/errors/email/storage)pnpm run typecheck— cleanapps/api/src/github-app.test.ts(appEventSubscriptionsunit tests),apps/api/src/routes/github-health-route.test.ts(route: not-configured, ok, missing-events, upstream-failure, 401),packages/uploads/test/commands-github-doctor.test.ts(CLI: ok/missing/not-configured/--json/404-degrade)Addresses the webhook-subscription follow-up on #293 (leaving the issue open — it also covers phases beyond this).