feat(slack): add flyteplugins-slack

Receive Slack webhooks in Flyte. Exports SlackProvider, a Provider subclass with its
defaults pre-wired, so wiring it up reads:

    WebhookAppEnvironment(providers=[SlackProvider()])

The receiver itself ships with flyte, at flyte.extras.webhooks; this package
contributes only what is specific to Slack -- which environment variable holds
the secret, how to verify a delivery, how to parse one into a WebhookEvent, and
typed constants for every event Slack sends.

examples/slack_webhooks.py runs with no Slack account at all: --local replays
this plugin's own SAMPLE_DELIVERY through the app. The shared conformance check
exercises that same sample.

The package is named for the product rather than for webhooks, so client
methods can land here later when they earn their place -- as review_pr does in
flyteplugins-github, where flyte.new_condition is the part no vendor SDK can
provide. Plain API passthrough belongs in the vendor's own SDK.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VKZrTNjjWVzTZUxDFbn4Nk
Signed-off-by: Niels Bantilan <niels.bantilan@gmail.com>

Author: cosmicBboy

plugins/slack/README.md

@@ -0,0 +1,85 @@
+# flyteplugins-slack
+
+Receive Slack webhooks in Flyte.
+
+```bash
+pip install "flyteplugins-slack[app]"
+```
+
+## Using it
+
+Hand a `SlackProvider()` to a `WebhookAppEnvironment` and register handlers with the
+typed constants in `events`:
+
+```python
+import flyte
+from flyte.extras.webhooks import DuplicateRun, WebhookAppEnvironment, idempotent_run
+from flyteplugins.slack import SlackProvider, events
+
+app_env = WebhookAppEnvironment(
+    name="slack-webhooks",
+    providers=[SlackProvider()],
+    secrets=[flyte.Secret("SLACK_SIGNING_SECRET", as_env_var="SLACK_SIGNING_SECRET")],
+)
+
+
+@app_env.on_event(events.AppMention.ANY)
+async def handle(event):
+    import flyte.remote as remote
+
+    task = remote.Task.get(name="my-env.my_task", auto_version="latest")
+    try:
+        run = await idempotent_run.aio(task, key=event.dedupe_key(), resource=event.resource_id)
+    except DuplicateRun as exc:
+        return {"skipped": str(exc)}
+    return {"run": run.name}
+
+
+flyte.serve(app_env)
+```
+
+Handlers must `await idempotent_run.aio(...)`. The blocking form stalls the
+app's event loop, and Slack times deliveries out in seconds.
+
+One app can serve several products at once — hand it one provider per product.
+
+## Try it
+
+`examples/slack_webhooks.py` runs two ways. The first needs no Slack account:
+
+```bash
+python examples/slack_webhooks.py --local   # replay a real sample delivery in-process
+python examples/slack_webhooks.py           # deploy the receiver to Flyte
+```
+
+`--local` posts this plugin's `SAMPLE_DELIVERY` through the app with FastAPI's
+test client, so you see a delivery verified, normalized, and dispatched — plus
+an unsigned one refused with a 401, and the same delivery replayed to show the
+dedupe key is stable.
+
+## Setup
+
+1. Store the secret and mount it on the app:
+   ```bash
+   flyte create secret SLACK_SIGNING_SECRET --value <secret>
+   ```
+2. Point Slack at `<app-url>/webhook/slack`, from
+   api.slack.com/apps → Event Subscriptions, then subscribe to bot events.
+
+Slack POSTs a `url_verification` challenge before events flow; it is echoed automatically, so the Request URL field verifies itself.
+
+**Verification:** HMAC-SHA256 over `v0:{timestamp}:{body}`, with a five-minute replay window (`X-Slack-Signature`).
+
+Messages are keyed per message, so each one launches its own run. To collapse a whole thread onto one run, pass `event.payload["event"]["thread_ts"]` as your own key.
+
+## Event constants
+
+`events` spells every event this plugin can dispatch, as `str` enums grouped by
+event type, so a typo fails at import rather than by silently never matching.
+Raw strings still work, for events the constants do not cover yet.
+
+## What this plugin does not do
+
+Call the Slack API. Use `slack_sdk` directly from your tasks — see
+`examples/external_saas_integrations`. This plugin owns only the part that is
+Flyte's: authenticating an inbound delivery and turning it into a run.

plugins/slack/examples/slack_webhooks.py

@@ -0,0 +1,127 @@
+"""Receive Slack webhooks in Flyte, and see one arrive without leaving your laptop.
+
+Two ways to run this. The second needs no Slack account at all:
+
+    python slack_webhooks.py --local   # replay a real sample delivery in-process
+    python slack_webhooks.py           # deploy the receiver to Flyte
+
+`--local` runs the app through FastAPI's test client and posts this plugin's
+`SAMPLE_DELIVERY` — an `app_mention` event callback — signed with a throwaway secret. You see the
+delivery verified, normalized, and dispatched to a handler, which is the whole
+path a real webhook takes.
+
+To receive real events, deploy it and point Slack at `<app-url>/webhook/slack`
+from api.slack.com/apps -> Event Subscriptions, then subscribe to bot events.
+
+Setup for the real thing:
+    flyte create secret SLACK_SIGNING_SECRET --value <secret>
+
+The signing secret is under *Basic Information* in your Slack app.
+"""
+
+import os
+import sys
+
+import flyte
+from flyte.extras.webhooks import WebhookAppEnvironment
+
+from flyteplugins.slack import DEFAULT_SECRET_ENV, SAMPLE_DELIVERY, SlackProvider, events
+
+image = flyte.Image.from_debian_base(python_version=(3, 12)).with_pip_packages("flyteplugins-slack[app]")
+
+app_env = WebhookAppEnvironment(
+    name="slack-webhooks",
+    providers=[SlackProvider()],
+    image=image,
+    secrets=[flyte.Secret(DEFAULT_SECRET_ENV, as_env_var=DEFAULT_SECRET_ENV)],
+)
+
+
+@app_env.on_event(events.AppMention.ANY)
+async def on_primary(event):
+    """React to the event this plugin's sample delivery carries.
+
+    Returning a dict is enough to see the path working. To do real work, launch
+    a deployed task instead — see `launch_a_task` below.
+    """
+    return {
+        "saw": event.qualified_type,
+        "resource": event.resource_id,
+        "title": event.title,
+        # The key `idempotent_run` would dedupe on. Replaying the same delivery
+        # produces the same key, which is what makes a redelivery a no-op.
+        "dedupe_key": event.dedupe_key(),
+    }
+
+
+@app_env.on_event(events.Reaction.ADDED)
+async def on_secondary(event):
+    """A second handler, to show dispatch picking the right one per event."""
+    return {"saw": event.qualified_type, "resource": event.resource_id}
+
+
+async def launch_a_task(event):
+    """What a handler looks like once it does real work.
+
+    Not registered above, because it needs `slack-notify.answer_mention` deployed first
+    and a Flyte backend to launch into. Wire it up with:
+
+        @app_env.on_event(events.AppMention.ANY)
+
+    `idempotent_run` refuses to launch when a run carrying the same dedupe key
+    is already live or has succeeded, so Slack redelivering an event — which
+    it does on any non-2xx — never starts a second run.
+    """
+    import flyte.remote as remote
+    from flyte.extras.webhooks import DuplicateRun, idempotent_run
+
+    task = remote.Task.get(name="slack-notify.answer_mention", auto_version="latest")
+    try:
+        # Always `.aio`: the blocking form stalls the app's event loop, and
+        # webhook senders time deliveries out in seconds.
+        run = await idempotent_run.aio(
+            task,
+            key=event.dedupe_key(),
+            channel=event.scope,
+            thread_ts=event.payload["event"].get("thread_ts") or event.payload["event"]["ts"],
+            question=event.payload["event"].get("text", ""),
+        )
+    except DuplicateRun as exc:
+        return {"skipped": str(exc)}
+    return {"run": run.name}
+
+
+def _try_locally() -> None:
+    """Post this plugin's sample delivery to the app, in-process."""
+    from fastapi.testclient import TestClient
+
+    secret = os.environ.setdefault(DEFAULT_SECRET_ENV, "local-trial-secret")
+    build_headers, body = SAMPLE_DELIVERY
+    client = TestClient(app_env.app)
+
+    print("POST /webhook/slack  (signed with a throwaway secret)")
+    response = client.post("/webhook/slack", content=body, headers=build_headers(body, secret))
+    print(f"  {response.status_code}  {response.json()}\n")
+
+    print("the same delivery again — note the identical dedupe_key:")
+    again = client.post("/webhook/slack", content=body, headers=build_headers(body, secret))
+    print(f"  {again.status_code}  {again.json()}\n")
+
+    print("an unsigned delivery is refused:")
+    bad = client.post("/webhook/slack", content=body, headers={})
+    print(f"  {bad.status_code}  {bad.json()}\n")
+
+    print("normalized events the app has seen:")
+    for seen in client.get("/api/events").json():
+        print(f"  {seen['provider']}  {seen['qualified_type']}  resource={seen['resource_id']}")
+
+
+if __name__ == "__main__":
+    if "--local" in sys.argv:
+        _try_locally()
+    else:
+        flyte.init_from_config()
+        handle = flyte.serve(app_env)
+        handle.activate(wait=True)
+        print(f"Dashboard ready at {handle.endpoint}")
+        print(f"Point Slack at {handle.endpoint}/webhook/slack")

plugins/slack/pyproject.toml

@@ -0,0 +1,59 @@
+[project]
+name = "flyteplugins-slack"
+dynamic = ["version"]
+description = "Receive Slack webhooks in Flyte."
+readme = "README.md"
+authors = [{ name = "Flyte Contributors" }]
+requires-python = ">=3.10"
+# The webhook receiver lives in flyte itself, at flyte.extras.webhooks.
+dependencies = ["flyte"]
+
+[project.optional-dependencies]
+app = ["fastapi>=0.115", "uvicorn>=0.30"]
+
+[build-system]
+requires = ["setuptools", "setuptools_scm"]
+build-backend = "setuptools.build_meta"
+
+[dependency-groups]
+dev = [
+    "pytest>=8.3.5",
+    "pytest-asyncio>=0.26.0",
+    "fastapi>=0.115",
+    "uvicorn>=0.30",
+    "httpx>=0.27",
+]
+
+[tool.setuptools]
+include-package-data = true
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["flyteplugins*"]
+
+[tool.setuptools_scm]
+root = "../../"
+
+[tool.pytest.ini_options]
+norecursedirs = []
+log_cli = true
+log_cli_level = 20
+markers = []
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+
+[tool.coverage.run]
+branch = true
+
+[tool.ruff]
+line-length = 120
+
+[tool.ruff.lint]
+select = ["E", "W", "F", "I", "PLW", "YTT", "ASYNC", "C4", "T10", "EXE", "ISC", "LOG", "PIE", "Q", "RSE", "FLY", "PGH", "PLC", "PLE", "FURB", "RUF"]
+ignore = ["PGH003", "PLC0415"]
+
+[tool.ruff.lint.per-file-ignores]
+"examples/*" = ["E402"]
+
+[tool.uv.sources]
+flyte = { path = "../../", editable = true }

plugins/slack/src/flyteplugins/slack/__init__.py

@@ -0,0 +1,44 @@
+"""Slack webhooks (Events API) for Flyte.
+
+Hand a `SlackProvider()` to a `WebhookAppEnvironment` and register handlers with the
+typed constants in `events`. Calling the Slack API is not this plugin's job —
+use `slack_sdk` from your tasks. See `examples/external_saas_integrations`.
+"""
+
+import hashlib
+import hmac
+import time
+
+from . import events
+from ._provider import DEFAULT_SECRET_ENV, MAX_REQUEST_AGE_SECONDS, SlackProvider, handshake, parse, verify
+
+__all__ = [
+    "DEFAULT_SECRET_ENV",
+    "MAX_REQUEST_AGE_SECONDS",
+    "SAMPLE_DELIVERY",
+    "SlackProvider",
+    "events",
+    "handshake",
+    "parse",
+    "verify",
+]
+
+
+def _sample_headers(body: bytes, secret: str) -> dict[str, str]:
+    # Signed at "now" so the delivery is inside the replay window whenever
+    # conformance runs.
+    timestamp = str(int(time.time()))
+    base = b"v0:" + timestamp.encode() + b":" + body
+    signature = hmac.new(secret.encode(), base, hashlib.sha256).hexdigest()
+    return {"X-Slack-Request-Timestamp": timestamp, "X-Slack-Signature": f"v0={signature}"}
+
+
+#: A real `app_mention` event callback, trimmed to the fields the parser reads.
+SAMPLE_DELIVERY = (
+    _sample_headers,
+    (
+        b'{"event_id": "Ev00000000", "team_id": "T00000000",'
+        b' "event": {"type": "app_mention", "channel": "C00000000", "ts": "1700000000.000100",'
+        b' "user": "U00000000", "text": "<@U0BOT> can you look at this"}}'
+    ),
+)