feat(github): add flyteplugins-github (webhooks + review_pr gate) - #1513
Merged
Conversation
cosmicBboy
force-pushed
the
nielsb/webhooks-github
branch
from
September 1, 2026 17:35
aea3037 to
b343898
Compare
cosmicBboy
marked this pull request as ready for review
September 1, 2026 17:54
cosmicBboy
force-pushed
the
nielsb/webhooks-core
branch
from
September 1, 2026 18:29
835df12 to
8dd4829
Compare
cosmicBboy
force-pushed
the
nielsb/webhooks-github
branch
from
September 1, 2026 18:29
b343898 to
0c00cc4
Compare
cosmicBboy
force-pushed
the
nielsb/webhooks-core
branch
from
September 1, 2026 18:54
8dd4829 to
46ac7e6
Compare
cosmicBboy
force-pushed
the
nielsb/webhooks-github
branch
from
September 1, 2026 18:54
0c00cc4 to
08c96a7
Compare
cosmicBboy
force-pushed
the
nielsb/webhooks-core
branch
from
September 2, 2026 00:55
46ac7e6 to
b9e6cd6
Compare
cosmicBboy
force-pushed
the
nielsb/webhooks-github
branch
from
September 2, 2026 00:55
08c96a7 to
ab54b78
Compare
cosmicBboy
changed the title
cosmicBboy
force-pushed
the
nielsb/webhooks-core
branch
from
September 2, 2026 01:03
b9e6cd6 to
033e469
Compare
cosmicBboy
force-pushed
the
nielsb/webhooks-github
branch
from
September 2, 2026 01:03
ab54b78 to
78f4523
Compare
Receive GitHub webhooks in Flyte, and gate a workflow on a human PR review.
Exports GitHubProvider, a Provider subclass with its defaults pre-wired, so
wiring up the receiver reads:
WebhookAppEnvironment(providers=[GitHubProvider()])
The receiver itself ships with flyte, at flyte.extras.webhooks; this package
contributes what is specific to GitHub -- which environment variable holds the
secret, how to verify a delivery, how to parse one into a WebhookEvent, and
typed constants for every event GitHub sends.
It also exports review_pr, which parks a run on a flyte.new_condition carrying
the pull request's metadata as JSON and returns a typed decision. That is the
shape of method worth putting in a plugin: the condition is the part no vendor
SDK can provide. Reading the pull request is PyGithub's job, called directly
behind a [review] extra rather than wrapped, so a webhook-only install stays on
flyte alone.
examples/github_webhooks.py runs with no GitHub account at all: --local replays
this plugin's own SAMPLE_DELIVERY through the app, so you can watch a delivery
be verified, normalized, and dispatched before wiring anything up. The shared
conformance check exercises that same sample.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VKZrTNjjWVzTZUxDFbn4Nk
Signed-off-by: Niels Bantilan <niels.bantilan@gmail.com>
cosmicBboy
force-pushed
the
nielsb/webhooks-core
branch
from
September 2, 2026 01:32
033e469 to
8f47dd7
Compare
cosmicBboy
force-pushed
the
nielsb/webhooks-github
branch
from
September 2, 2026 01:32
78f4523 to
538223a
Compare
cosmicBboy
changed the title
Part of the webhook plugin stack. Requires #1512 (`flyteplugins-webhooks-core`), which is this PR's base — the diff here is just this package. Receive Slack webhooks in Flyte. ## What it implements The `Provider` contract from core: which environment variable holds the secret, how to verify a delivery, how to parse one into a `WebhookEvent`, plus typed constants for every event Slack sends. **Verification:** HMAC-SHA256 over `v0:{timestamp}:{body}`, with a five-minute replay window. Echoes the `url_verification` challenge, so Slack's Request URL field verifies itself. The signature covers the **raw bytes**. Decoding the body and re-encoding it would corrupt any byte Slack signed but Python cannot decode, and running the timestamp through `int()` would drop whatever formatting Slack signed — a test pins both. ## Conformance Runs the shared `assert_provider_conforms`, which replays this plugin's `SAMPLE_DELIVERY` — a real Slack payload — through `verify` and `parse` rather than trusting them to agree with each other. It also asserts the verifier returns False rather than raising on a hostile header, that event constants render as wire values rather than enum names, and that the sample parses to something the constants actually spell. 6 tests. `make fmt`, `make mypy`, `make ty`, ruff, and codespell pass. ## What it does not do Call the Slack API. Use `slack_sdk` directly from your tasks — the recipes are in the examples PR at the end of this stack. This plugin owns only the part that is Flyte's: authenticating an inbound delivery and turning it into a run. --------- Signed-off-by: Niels Bantilan <niels.bantilan@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the webhook plugin stack. Requires #1512 (
flyteplugins-webhooks-core), which is this PR's base — the diff here is just this package.Receive GitHub webhooks in Flyte.
What it implements
The
Providercontract from core: which environment variable holds the secret, how to verify a delivery, how to parse one into aWebhookEvent, plus typed constants for every event GitHub sends.Verification: HMAC-SHA256 over the raw body (
X-Hub-Signature-256).Answers GitHub's
pingautomatically, so a green check in Recent Deliveries means the app is reachable.Comment and review events fold the comment id into
resource_id, so two comments on one issue are two events rather than a redelivery of the first — the bug that prompted this whole restructure.Conformance
Runs the shared
assert_provider_conforms, which replays this plugin'sSAMPLE_DELIVERY— a real GitHub payload — throughverifyandparserather than trusting them to agree with each other. It also asserts the verifier returns False rather than raising on a hostile header, that event constants render as wire values rather than enum names, and that the sample parses to something the constants actually spell.7 tests.
make fmt,make mypy,make ty, ruff, and codespell pass.What it does not do
Call the GitHub API. Use
PyGithubdirectly from your tasks — the recipes are in the examples PR at the end of this stack. This plugin owns only the part that is Flyte's: authenticating an inbound delivery and turning it into a run.