feat(webhooks): add flyteplugins-webhooks-slack

Receive Slack webhooks in Flyte. Implements the Provider contract from
flyteplugins-webhooks-core: which environment variable holds the secret, how to
verify a delivery, how to parse one into a WebhookEvent, plus typed constants
for every event Slack can send.

Runs the shared conformance check, which replays a real SAMPLE_DELIVERY through
verify and parse rather than trusting them to agree with each other.

Calling the Slack API is deliberately not this plugin's job.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VKZrTNjjWVzTZUxDFbn4Nk
Signed-off-by: Niels Bantilan <niels.bantilan@gmail.com>

Author: cosmicBboy

plugins/webhooks/slack/README.md

@@ -0,0 +1,71 @@
+# flyteplugins-webhooks-slack
+
+Receive Slack webhooks in Flyte.
+
+```bash
+pip install "flyteplugins-webhooks-core[app]" flyteplugins-webhooks-slack
+```
+
+## Using it
+
+Hand `PROVIDER` to a `WebhookAppEnvironment` and register handlers with the
+typed constants in `events`:
+
+```python
+import flyte
+from flyteplugins.webhooks.core import DuplicateRun, WebhookAppEnvironment, idempotent_run
+from flyteplugins.webhooks.slack import PROVIDER, events
+
+app_env = WebhookAppEnvironment(
+    name="slack-webhooks",
+    providers=[PROVIDER],
+    secrets=[flyte.Secret("SLACK_SIGNING_SECRET", as_env_var="SLACK_SIGNING_SECRET")],
+)
+
+
+@app_env.on_event(events.AppMention.ANY)
+async def handle(event):
+    import flyte.remote as remote
+
+    task = remote.Task.get(name="my-env.my_task", auto_version="latest")
+    try:
+        run = await idempotent_run.aio(task, key=event.dedupe_key(), resource=event.resource_id)
+    except DuplicateRun as exc:
+        return {"skipped": str(exc)}
+    return {"run": run.name}
+
+
+flyte.serve(app_env)
+```
+
+Handlers must `await idempotent_run.aio(...)`. The blocking form stalls the
+app's event loop, and Slack times deliveries out in seconds.
+
+One app can serve several products at once — hand it more than one `PROVIDER`.
+
+## Setup
+
+1. Store the secret and mount it on the app:
+   ```bash
+   flyte create secret SLACK_SIGNING_SECRET --value <secret>
+   ```
+2. Point Slack at `<app-url>/webhook/slack`, from
+   api.slack.com/apps → Event Subscriptions, then subscribe to bot events.
+
+Slack POSTs a `url_verification` challenge before events flow; it is echoed automatically, so the Request URL field verifies itself.
+
+**Verification:** HMAC-SHA256 over `v0:{timestamp}:{body}`, with a five-minute replay window (`X-Slack-Signature`).
+
+Messages are keyed per message, so each one launches its own run. To collapse a whole thread onto one run, pass `event.payload["event"]["thread_ts"]` as your own key.
+
+## Event constants
+
+`events` spells every event this plugin can dispatch, as `str` enums grouped by
+event type, so a typo fails at import rather than by silently never matching.
+Raw strings still work, for events the constants do not cover yet.
+
+## What this plugin does not do
+
+Call the Slack API. Use `slack_sdk` directly from your tasks — see
+`examples/external_saas_integrations`. This plugin owns only the part that is
+Flyte's: authenticating an inbound delivery and turning it into a run.

plugins/webhooks/slack/pyproject.toml

@@ -0,0 +1,56 @@
+[project]
+name = "flyteplugins-webhooks-slack"
+dynamic = ["version"]
+description = "Receive Slack webhooks in Flyte."
+readme = "README.md"
+authors = [{ name = "Flyte Contributors" }]
+requires-python = ">=3.10"
+dependencies = ["flyteplugins-webhooks-core"]
+
+[build-system]
+requires = ["setuptools", "setuptools_scm"]
+build-backend = "setuptools.build_meta"
+
+[dependency-groups]
+dev = [
+    "pytest>=8.3.5",
+    "pytest-asyncio>=0.26.0",
+    "fastapi>=0.115",
+    "uvicorn>=0.30",
+    "httpx>=0.27",
+]
+
+[tool.setuptools]
+include-package-data = true
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["flyteplugins*"]
+
+[tool.setuptools_scm]
+root = "../../.."
+
+[tool.pytest.ini_options]
+norecursedirs = []
+log_cli = true
+log_cli_level = 20
+markers = []
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+
+[tool.coverage.run]
+branch = true
+
+[tool.ruff]
+line-length = 120
+
+[tool.ruff.lint]
+select = ["E", "W", "F", "I", "PLW", "YTT", "ASYNC", "C4", "T10", "EXE", "ISC", "LOG", "PIE", "Q", "RSE", "FLY", "PGH", "PLC", "PLE", "FURB", "RUF"]
+ignore = ["PGH003", "PLC0415"]
+
+[tool.ruff.lint.per-file-ignores]
+"examples/*" = ["E402"]
+
+[tool.uv.sources]
+flyte = { path = "../../..", editable = true }
+flyteplugins-webhooks-core = { path = "../core", editable = true }

plugins/webhooks/slack/src/flyteplugins/webhooks/slack/__init__.py

@@ -0,0 +1,43 @@
+"""Slack webhooks (Events API) for Flyte.
+
+Hand `PROVIDER` to a `WebhookAppEnvironment` and register handlers with the
+typed constants in `events`. Calling the Slack API is not this plugin's job —
+use `slack_sdk` from your tasks. See `examples/external_saas_integrations`.
+"""
+
+import hashlib
+import hmac
+import time
+
+from . import events
+from ._provider import MAX_REQUEST_AGE_SECONDS, PROVIDER, handshake, parse, verify
+
+__all__ = [
+    "MAX_REQUEST_AGE_SECONDS",
+    "PROVIDER",
+    "SAMPLE_DELIVERY",
+    "events",
+    "handshake",
+    "parse",
+    "verify",
+]
+
+
+def _sample_headers(body: bytes, secret: str) -> dict[str, str]:
+    # Signed at "now" so the delivery is inside the replay window whenever
+    # conformance runs.
+    timestamp = str(int(time.time()))
+    base = b"v0:" + timestamp.encode() + b":" + body
+    signature = hmac.new(secret.encode(), base, hashlib.sha256).hexdigest()
+    return {"X-Slack-Request-Timestamp": timestamp, "X-Slack-Signature": f"v0={signature}"}
+
+
+#: A real `app_mention` event callback, trimmed to the fields the parser reads.
+SAMPLE_DELIVERY = (
+    _sample_headers,
+    (
+        b'{"event_id": "Ev00000000", "team_id": "T00000000",'
+        b' "event": {"type": "app_mention", "channel": "C00000000", "ts": "1700000000.000100",'
+        b' "user": "U00000000", "text": "<@U0BOT> can you look at this"}}'
+    ),
+)

plugins/webhooks/slack/src/flyteplugins/webhooks/slack/_provider.py

@@ -0,0 +1,85 @@
+"""Slack Events API verification and payload normalization."""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import time
+from typing import Any, Mapping
+
+from flyteplugins.webhooks.core import (
+    Provider,
+    SignatureError,
+    WebhookEvent,
+    constant_time_equals,
+    json_body,
+    lower_headers,
+)
+
+#: Reject requests whose timestamp is older than this (replay protection).
+MAX_REQUEST_AGE_SECONDS = 60 * 5
+
+
+def verify(body: bytes, headers: Mapping[str, str], secret: str) -> bool:
+    """Verify the `X-Slack-Signature` v0 HMAC, within the replay window."""
+    lowered = lower_headers(headers)
+    timestamp, signature = lowered.get("x-slack-request-timestamp"), lowered.get("x-slack-signature")
+    if not timestamp or not signature or not signature.startswith("v0="):
+        return False
+    try:
+        sent_at = int(timestamp)
+    except ValueError:
+        return False
+    if abs(time.time() - sent_at) > MAX_REQUEST_AGE_SECONDS:
+        return False
+    # Sign the raw bytes and the raw header. Decoding the body and re-encoding it
+    # would corrupt any byte Slack signed but Python cannot decode, and running
+    # the timestamp through int() would drop whatever formatting Slack signed.
+    basestring = b"v0:" + timestamp.encode("utf-8") + b":" + body
+    expected = "v0=" + hmac.new(secret.encode("utf-8"), basestring, hashlib.sha256).hexdigest()
+    return constant_time_equals(expected, signature)
+
+
+def handshake(headers: Mapping[str, str], body: bytes) -> dict[str, Any] | None:
+    """Echo the `url_verification` challenge Slack sends before events flow."""
+    try:
+        data = json.loads(body.decode("utf-8")) if body else {}
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        return None
+    if isinstance(data, dict) and data.get("type") == "url_verification":
+        return {"challenge": str(data.get("challenge", ""))}
+    return None
+
+
+def parse(headers: Mapping[str, str], body: bytes) -> WebhookEvent:
+    """Normalize a Slack event callback into a `WebhookEvent`."""
+    payload = json_body(body)
+    event = payload.get("event") or {}
+    if not isinstance(event, dict) or not event:
+        raise SignatureError("event payload is missing its `event` object")
+    channel, ts = event.get("channel"), event.get("ts")
+    return WebhookEvent(
+        provider="slack",
+        event_type=event.get("type", "unknown"),
+        action=event.get("subtype"),
+        delivery_id=payload.get("event_id", ""),
+        # Keyed per message. Collapse a whole thread onto one run by passing
+        # `event.payload["event"]["thread_ts"]` as your own key instead.
+        resource_id=f"{channel}:{ts}" if channel and ts else None,
+        scope=channel,
+        title=(event.get("text") or "")[:120] or None,
+        actor=event.get("user"),
+        payload=payload,
+    )
+
+
+#: The contract core needs to accept Slack Events API deliveries.
+PROVIDER = Provider(
+    name="slack",
+    secret_env="SLACK_SIGNING_SECRET",
+    verify=verify,
+    parse=parse,
+    handshake=handshake,
+    setup_hint="api.slack.com/apps -> Event Subscriptions",
+)

plugins/webhooks/slack/src/flyteplugins/webhooks/slack/events.py

@@ -0,0 +1,80 @@
+"""Slack Events API events. `message` carries subtypes; the rest are bare types."""
+
+from __future__ import annotations
+
+from flyteplugins.webhooks.core import EventType
+
+__all__ = ["AppHome", "AppMention", "Channel", "File", "Member", "Message", "Pin", "Reaction", "Team"]
+
+
+class Message(EventType):
+    """`message` events. Members below are Slack's message subtypes."""
+
+    ANY = "message"
+    """Every message, including those carrying a subtype."""
+    CHANGED = "message.message_changed"
+    DELETED = "message.message_deleted"
+    REPLIED = "message.message_replied"
+    CHANNEL_JOIN = "message.channel_join"
+    CHANNEL_LEAVE = "message.channel_leave"
+    BOT_MESSAGE = "message.bot_message"
+    FILE_SHARE = "message.file_share"
+    THREAD_BROADCAST = "message.thread_broadcast"
+
+
+class AppMention(EventType):
+    """`app_mention` events — the bot was @-mentioned. No subtype."""
+
+    ANY = "app_mention"
+
+
+class Reaction(EventType):
+    """Emoji reaction events."""
+
+    ADDED = "reaction_added"
+    REMOVED = "reaction_removed"
+
+
+class Channel(EventType):
+    """Channel lifecycle events."""
+
+    CREATED = "channel_created"
+    DELETED = "channel_deleted"
+    RENAME = "channel_rename"
+    ARCHIVE = "channel_archive"
+    UNARCHIVE = "channel_unarchive"
+
+
+class Member(EventType):
+    """Channel membership events."""
+
+    JOINED_CHANNEL = "member_joined_channel"
+    LEFT_CHANNEL = "member_left_channel"
+
+
+class Team(EventType):
+    """Workspace-level events."""
+
+    JOIN = "team_join"
+    """A new member joined the workspace."""
+
+
+class File(EventType):
+    """File events."""
+
+    CREATED = "file_created"
+    SHARED = "file_shared"
+    DELETED = "file_deleted"
+
+
+class Pin(EventType):
+    """Pinned-item events."""
+
+    ADDED = "pin_added"
+    REMOVED = "pin_removed"
+
+
+class AppHome(EventType):
+    """App Home events."""
+
+    OPENED = "app_home_opened"

plugins/webhooks/slack/tests/test_conformance.py

@@ -0,0 +1,16 @@
+"""Every provider plugin runs the same conformance check.
+
+CI fails here if this plugin drifts from the shared format: a verifier that
+raises instead of returning False, event constants that render as enum names, a
+sample delivery that no constant spells, an unstable dedupe key.
+"""
+
+from __future__ import annotations
+
+from flyteplugins.webhooks.core.testing import assert_provider_conforms
+
+import flyteplugins.webhooks.slack as plugin
+
+
+def test_conformance():
+    assert_provider_conforms(plugin)