feat: add GitHub webhook support and AI review trigger functionality: - #273
feat: add GitHub webhook support and AI review trigger functionality:#273yashdev9274 wants to merge 1 commit into
Conversation
- Introduced a new API route for manually triggering AI reviews via POST requests, allowing users to queue reviews for connected repositories. - Enhanced GitHub webhook handling to verify signatures and process pull request events, ensuring secure and reliable integration with GitHub. - Updated environment configuration to include necessary keys for GitHub webhooks and AI review services. - Improved the dashboard logs page to display AI review history, providing users with insights into review activities and statuses. - Refactored existing code for better organization and maintainability, ensuring a cleaner architecture for future enhancements.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Greptile SummaryThis PR adds authenticated manual review triggering, expands signed GitHub webhook processing, moves AI review generation into a richer retrying Inngest workflow, and displays recent review status on the dashboard.
Confidence Score: 2/5This PR should not merge until webhook verification fails closed, terminal worker failures update persisted status, and manual trigger input requires an integer pull-request number. Missing webhook configuration currently bypasses the request-authenticity boundary, worker retry exhaustion leaves user-visible records permanently pending, and malformed fractional PR identifiers pass the new route's validation. Files Needing Attention: apps/web/app/api/webhooks/github/route.ts, apps/web/inngest/functions/ai-review.ts, apps/web/app/api/reviews/trigger/route.ts
|
| Filename | Overview |
|---|---|
| apps/web/app/api/webhooks/github/route.ts | Expands pull-request event handling but accepts unauthenticated deliveries whenever the webhook secret is missing. |
| apps/web/inngest/functions/ai-review.ts | Adds a richer retrying AI-review workflow, but exhausted failures leave persisted reviews indefinitely pending. |
| apps/web/app/api/reviews/trigger/route.ts | Adds an authenticated manual trigger scoped to the user's repository, but permits fractional pull-request numbers. |
| apps/web/modules/ai/action/index.ts | Queues reviews and persists initial status, while only enqueue-time failures are recorded as failed. |
| apps/web/modules/github/lib/github.ts | Adds webhook refresh, richer PR metadata, sticky comments, and formal reviews, but permits webhook configuration without a signing secret. |
| apps/web/app/dashboard/logs/page.tsx | Displays the latest review records scoped to the authenticated user's connected repositories. |
Sequence Diagram
sequenceDiagram
participant G as GitHub or Caller
participant W as Webhook or Trigger API
participant D as Database
participant I as Inngest
participant A as AI Gateway
participant P as GitHub PR
G->>W: Pull request event or manual request
W->>D: Resolve connected repository
W->>D: Mark review pending
W->>I: Send pr.review.requested
I->>P: Fetch PR metadata and diff
I->>A: Generate review
A-->>I: Review markdown
I->>P: Upsert comment and submit review
I->>D: Mark review completed
Reviews (1): Last reviewed commit: "feat: add GitHub webhook support and AI ..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| console.error("[webhook/github] invalid signature") | ||
| return NextResponse.json({ error: "Invalid signature" }, { status: 401 }) | ||
| } | ||
| } else { | ||
| console.warn( | ||
| "[webhook/github] GITHUB_WEBHOOK_SECRET is not set — accepting unsigned payloads (dev only)", | ||
| ) | ||
| } |
There was a problem hiding this comment.
If GITHUB_WEBHOOK_SECRET is absent in a public deployment, this branch accepts unsigned pull-request payloads and forwards attacker-controlled repository and PR identifiers into the review workflow, allowing unauthenticated callers to consume AI resources and post reviews using a connected user's GitHub token. How this was verified: The unsigned request path was traced through reviewPullRequest to the worker that loads the repository owner's token and posts the generated review.
| export const generateReview = inngest.createFunction( | ||
| { | ||
| id: "generate-review", | ||
| concurrency: 5, | ||
| retries: 2, | ||
| }, |
There was a problem hiding this comment.
When PR fetching, AI generation, comment posting, or persistence exhausts these retries, no failure handler transitions the already-created review record to failed, causing the dashboard to report a terminally failed review as in progress indefinitely.
| const repo = String(body.repo ?? "").trim() | ||
| const prNumber = Number(body.prNumber) | ||
|
|
||
| if (!owner || !repo || !Number.isFinite(prNumber) || prNumber <= 0) { |
There was a problem hiding this comment.
When an authenticated caller supplies a positive fractional value such as 1.5, this validation accepts it and forwards it to the GitHub API, causing an invalid job or internal error instead of returning a client validation error.
| if (!owner || !repo || !Number.isFinite(prNumber) || prNumber <= 0) { | |
| if (!owner || !repo || !Number.isInteger(prNumber) || prNumber <= 0) { |
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
1 participant
Description
Type of change
How Has This Been Tested?
Please describe the tests that you ran to verify your changes.
bun testpassesbun run typecheckpassesbun run lintpasses (if applicable)Checklist: