feat(triggers): add GitLab, PagerDuty, and Zendesk webhook triggers#5150
feat(triggers): add GitLab, PagerDuty, and Zendesk webhook triggers#5150waleedlatif1 wants to merge 2 commits into
Conversation
Add webhook trigger support for three integrations that previously had blocks but no triggers: - GitLab: push, merge request, issue, pipeline, comment, and all-events. Verifies the X-Gitlab-Token secret token; filters by object_kind. - PagerDuty: incident triggered/acknowledged/resolved/escalated/reassigned and all-events. Verifies X-PagerDuty-Signature (HMAC-SHA256 over raw body, comma-separated rotation); idempotency on event id. - Zendesk: ticket created/status changed/comment added/priority changed and all-events. Verifies X-Zendesk-Webhook-Signature (base64 HMAC-SHA256 over timestamp+body); idempotency on event id. Register GitLab's X-Gitlab-Event-UUID delivery header for webhook idempotency dedup.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryMedium Risk Overview The GitLab, PagerDuty, and Zendesk blocks now allow triggers ( New webhook provider handlers ( Trigger definitions, setup copy, and shared utils live under Reviewed by Cursor Bugbot for commit c2e7e01. Configure here. |
|
@greptile review |
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit fd4de8d. Configure here.
Greptile SummaryAdds first-class webhook triggers for GitLab, PagerDuty, and Zendesk — three integrations that had block definitions but no trigger support. All three follow the same manual-registration model as the existing GitHub trigger: the user creates the webhook in the provider UI, pastes the signing secret, and the platform verifies each delivery before dispatching.
Confidence Score: 5/5The change is safe to merge; all three signature verification schemes are correctly implemented and consistent with the existing GitHub handler pattern. All three providers implement correct HMAC/token verification, event filtering, and idempotency extraction. The Zendesk timestamp freshness check is properly implemented. The only gap is that PagerDuty lacks an equivalent timestamp staleness guard that Zendesk added in this same PR, but idempotency dedup on event.id provides a first line of replay protection — this is a hardening improvement rather than a blocking defect. apps/sim/lib/webhooks/providers/pagerduty.ts — lacks a timestamp freshness guard that the Zendesk handler in this same PR added. Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant P as Provider
participant W as Webhook Route
participant H as Provider Handler
participant IS as Idempotency Service
participant ME as matchEvent
participant FI as formatInput
participant WF as Workflow Executor
P->>W: "POST /webhook/{id}"
W->>H: verifyAuth(request, rawBody)
note over H: GitLab: safeCompare X-Gitlab-Token
note over H: PagerDuty: HMAC-SHA256 v1= rotation
note over H: Zendesk: base64 HMAC + timestamp freshness
H-->>W: null (ok) or 401
W->>IS: checkIdempotency(headers, body)
note over IS: GitLab: X-Gitlab-Event-UUID header
note over IS: PagerDuty: event.id body field
note over IS: Zendesk: body.id field
IS-->>W: isDuplicate?
W->>ME: matchEvent(body, triggerId)
note over ME: GitLab: object_kind == expected
note over ME: PagerDuty: event.event_type == expected
note over ME: Zendesk: body.type == expected
ME-->>W: true/false
W->>FI: formatInput(body, headers)
FI-->>W: structured input
W->>WF: execute(workflow, input)
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant P as Provider
participant W as Webhook Route
participant H as Provider Handler
participant IS as Idempotency Service
participant ME as matchEvent
participant FI as formatInput
participant WF as Workflow Executor
P->>W: "POST /webhook/{id}"
W->>H: verifyAuth(request, rawBody)
note over H: GitLab: safeCompare X-Gitlab-Token
note over H: PagerDuty: HMAC-SHA256 v1= rotation
note over H: Zendesk: base64 HMAC + timestamp freshness
H-->>W: null (ok) or 401
W->>IS: checkIdempotency(headers, body)
note over IS: GitLab: X-Gitlab-Event-UUID header
note over IS: PagerDuty: event.id body field
note over IS: Zendesk: body.id field
IS-->>W: isDuplicate?
W->>ME: matchEvent(body, triggerId)
note over ME: GitLab: object_kind == expected
note over ME: PagerDuty: event.event_type == expected
note over ME: Zendesk: body.type == expected
ME-->>W: true/false
W->>FI: formatInput(body, headers)
FI-->>W: structured input
W->>WF: execute(workflow, input)
Reviews (4): Last reviewed commit: "fix(triggers): scope webhook secrets to ..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
@greptile review |
Greptile SummaryAdds webhook trigger support for GitLab, PagerDuty, and Zendesk — three integrations that previously had blocks but no inbound trigger capability. Each follows the existing manual-registration pattern (user pastes the signing secret, no fragile auto-create calls).
Confidence Score: 4/5The three new integrations are well-structured and follow the established provider pattern; the only issues are a dead function parameter and a minor inconsistency in the Zendesk body guard. The signature verification logic for all three providers is correct, the event-matching maps align with documented payload shapes, and idempotency is wired up consistently. The apps/sim/triggers/gitlab/utils.ts (unused triggerLabel parameter) and apps/sim/lib/webhooks/providers/zendesk.ts (missing body guard in validateZendeskSignature). Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant P as Provider<br/>(GitLab/PagerDuty/Zendesk)
participant W as Webhook Route
participant R as Provider Registry
participant H as Provider Handler
participant I as Idempotency Service
participant Q as Execution Queue
P->>W: "POST /webhook/{id}"
W->>R: getHandler(provider)
R-->>W: gitlabHandler / pagerdutyHandler / zendeskHandler
W->>H: verifyAuth(secret, headers, rawBody)
alt Signature valid
H-->>W: null (pass)
else Invalid
H-->>W: 401 Unauthorized
end
W->>H: matchEvent(triggerId, body)
alt Event matches trigger
H-->>W: true
else No match
H-->>W: false (skip)
end
W->>I: checkIdempotency(x-gitlab-event-uuid / event.id / body.id)
alt Not a duplicate
I-->>W: proceed
W->>H: formatInput(body, headers)
H-->>W: "{ input: { ... } }"
W->>Q: enqueue execution
else Duplicate
I-->>W: skip (already processed)
end
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant P as Provider<br/>(GitLab/PagerDuty/Zendesk)
participant W as Webhook Route
participant R as Provider Registry
participant H as Provider Handler
participant I as Idempotency Service
participant Q as Execution Queue
P->>W: "POST /webhook/{id}"
W->>R: getHandler(provider)
R-->>W: gitlabHandler / pagerdutyHandler / zendeskHandler
W->>H: verifyAuth(secret, headers, rawBody)
alt Signature valid
H-->>W: null (pass)
else Invalid
H-->>W: 401 Unauthorized
end
W->>H: matchEvent(triggerId, body)
alt Event matches trigger
H-->>W: true
else No match
H-->>W: false (skip)
end
W->>I: checkIdempotency(x-gitlab-event-uuid / event.id / body.id)
alt Not a duplicate
I-->>W: proceed
W->>H: formatInput(body, headers)
H-->>W: "{ input: { ... } }"
W->>Q: enqueue execution
else Duplicate
I-->>W: skip (already processed)
end
|
…protection Address review feedback: - Add paramVisibility: 'user-only' to the webhookSecret fields for GitLab, PagerDuty, and Zendesk so signing secrets are scoped to the credential owner and not exposed to workspace collaborators (repo convention). - Reject Zendesk deliveries whose signed timestamp is more than 5 minutes from now, closing a replay window once an event id ages out of the idempotency cache. The X-Zendesk-Webhook-Signature-Timestamp header is ISO-8601, so it is parsed with Date.parse (matches the Slack handler's skew-check convention).
|
@greptile review |
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit c2e7e01. Configure here.
1 participant
Summary
X-Gitlab-Tokensecret token; filters byobject_kind.X-PagerDuty-Signature(HMAC-SHA256 over the raw body, handles comma-separated rotation signatures); dedups on event id.X-Zendesk-Webhook-Signature(base64 HMAC-SHA256 overtimestamp + body); dedups on event id.X-Gitlab-Event-UUIDdelivery header for webhook idempotency.All three use the manual-registration model (user creates the webhook in the provider UI, pastes the signing secret) consistent with the existing GitHub trigger — no fragile auto-create API calls. Every signature scheme, event string, and payload field was verified against the providers' live docs.
Type of Change
Testing
Tested manually:
bun run type-checkpasses; idempotency + provider handler tests pass. Output schema ↔formatInputalignment verified for all triggers. First real delivery from each provider is the standard post-merge smoke test.Checklist