Route GitHub webhook events to the correct environment based on PR origin by richardhjtan · Pull Request #4285 · cardstack/boxel

richardhjtan · 2026-03-31T08:21:40Z

Summary

GitHub webhook events are now routed only to the environment where the PR originated, instead of being broadcast to all environments (staging, production, local)
The realm origin is resolved from the Submission Card URL in the PR body, with a fallback DB lookup by PR number for events without PR body (e.g. check_run, check_suite)
Origin comparison ensures staging events stay on staging, production events stay on production
Fail-closed: if origin cannot be resolved for a PR-related event, the event is rejected rather than broadcast

How it works

pull_request, pull_request_review events — extract the Submission Card URL from the PR body, compare its origin against filter.realm. Reject if origins don't match.
check_run, check_suite events — no PR body available, so query boxel_index for a PrCard matching the PR number and compare its realm origin.
Fail-closed — if origin cannot be resolved from a PR-related event, the match is rejected to prevent cross-environment broadcast.

Test plan

Test with a staging PR — only staging environment should process the event
Test with a production PR — only production environment should process the event
Test check_run event routing via PrCard DB lookup
Verify fail-closed behavior when realm cannot be resolved

…igin

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0599110aed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Pull request overview

This PR updates the realm-server webhook receiver so GitHub webhook commands are routed to the correct environment (staging vs production vs local) by resolving the PR’s “origin realm” and comparing origins, rather than broadcasting events to all environments.

Changes:

Made webhook filter handlers async and added dynamic realm resolution from PR body (SubmissionCard URL) with DB fallback by PR number.
Updated the webhook receiver to pass dbAdapter into filter handlers and await async matching/input/realm resolution.
Added unit tests for helper extraction functions (extractRealmFromPrBody, extractPrNumberFromPayload).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
packages/realm-server/handlers/webhook-filter-handlers.ts	Adds realm/PR resolution helpers, DB lookup, origin-based filtering, and async handler interface.
packages/realm-server/handlers/handle-webhook-receiver.ts	Awaits async filter handler methods and passes `dbAdapter` through.
packages/realm-server/tests/server-endpoints/webhook-receiver-test.ts	Adds unit tests for PR-body realm extraction and PR-number extraction.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-03-31T08:42:19Z

Host Test Results

1 files ±0 1 suites ±0 2h 0m 22s ⏱️ - 11m 37s
2 062 tests ±0 2 047 ✅ ±0 15 💤 ±0 0 ❌ ±0
2 077 runs ±0 2 062 ✅ ±0 15 💤 ±0 0 ❌ ±0

Results for commit 9bad05d. ± Comparison against base commit bbc3db5.

♻️ This comment has been updated with latest results.

github-actions · 2026-03-31T08:46:49Z

Realm Server Test Results

1 files ± 0 1 suites ±0 11m 26s ⏱️ -19s
816 tests +14 816 ✅ +14 0 💤 ±0 0 ❌ ±0
887 runs +14 887 ✅ +14 0 💤 ±0 0 ❌ ±0

Results for commit 9bad05d. ± Comparison against base commit bbc3db5.

♻️ This comment has been updated with latest results.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d30292ca7f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-31T10:35:03Z

+    if (filter.realm) {
+      let resolvedOrigin = await resolveOriginFromPayload(payload, dbAdapter);


Limit origin checks to PR-linked events

matches() now calls resolveOriginFromPayload() for every github-event command that has filter.realm, regardless of event type. We still register commit_comment and discussion_comment commands with a realm in packages/matrix/scripts/register-github-webhook-for-submission-realm.ts (lines 235-247), but those payloads do not carry PR body/PR number fields, so origin resolution returns null and this branch rejects them every time. This regresses existing behavior by making those configured webhook commands impossible to execute.

Useful? React with 👍 / 👎.

richardhjtan · 2026-03-31T13:01:56Z

Tested branch changes in staging, the webhook event from production is not duplicate in staging

Production

Staging, Not found (Excepted)

backspace

I haven’t been looking at this work, is there validation that webhook requests are only processed from authorised sources?

richardhjtan · 2026-04-01T05:56:21Z

I haven’t been looking at this work, is there validation that webhook requests are only processed from authorised sources?

@backspace Yes, each incoming_webhook record has its own unique webhook endpoint and associated secret, which we use to verify that requests come from an authorised source.

Route GitHub webhook events to the correct environment based on PR or…

0599110

…igin

richardhjtan marked this pull request as draft March 31, 2026 08:21

richardhjtan requested a review from Copilot March 31, 2026 08:21

Copilot started reviewing on behalf of richardhjtan March 31, 2026 08:22 View session

chatgpt-codex-connector Bot reviewed Mar 31, 2026

View reviewed changes

Comment thread packages/realm-server/handlers/webhook-filter-handlers.ts

Comment thread packages/realm-server/handlers/webhook-filter-handlers.ts

Copilot AI reviewed Mar 31, 2026

View reviewed changes

richardhjtan requested a review from Copilot March 31, 2026 08:59

Copilot started reviewing on behalf of richardhjtan March 31, 2026 09:00 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

Comment thread packages/realm-server/handlers/webhook-filter-handlers.ts

Comment thread packages/realm-server/tests/server-endpoints/webhook-receiver-test.ts

Comment thread packages/realm-server/tests/server-endpoints/webhook-receiver-test.ts

richardhjtan force-pushed the CS-10384-route-github-webhook-event-based-on-origin branch from 91521de to 192b1ba Compare March 31, 2026 10:15

richardhjtan requested a review from Copilot March 31, 2026 10:16

Copilot started reviewing on behalf of richardhjtan March 31, 2026 10:16 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

Comment thread packages/realm-server/handlers/webhook-filter-handlers.ts Outdated

Comment thread packages/realm-server/handlers/webhook-filter-handlers.ts

Comment thread packages/realm-server/handlers/handle-webhook-receiver.ts

richardhjtan force-pushed the CS-10384-route-github-webhook-event-based-on-origin branch from 192b1ba to d30292c Compare March 31, 2026 10:28

richardhjtan requested review from a team March 31, 2026 10:29

richardhjtan marked this pull request as ready for review March 31, 2026 10:29

chatgpt-codex-connector Bot reviewed Mar 31, 2026

View reviewed changes

Address feedback

9bad05d

richardhjtan force-pushed the CS-10384-route-github-webhook-event-based-on-origin branch from d30292c to 9bad05d Compare March 31, 2026 12:29

github-actions Bot temporarily deployed to staging March 31, 2026 12:30 Inactive

backspace approved these changes Mar 31, 2026

View reviewed changes

tintinthong approved these changes Apr 1, 2026

View reviewed changes

tintinthong merged commit 019235c into main Apr 1, 2026
72 checks passed

		if (filter.realm) {
		let resolvedOrigin = await resolveOriginFromPayload(payload, dbAdapter);

Conversation

richardhjtan commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How it works

Test plan

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Host Test Results

Uh oh!

github-actions Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Realm Server Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

richardhjtan commented Mar 31, 2026

Uh oh!

backspace left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

richardhjtan commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

richardhjtan commented Mar 31, 2026 •

edited

Loading

github-actions Bot commented Mar 31, 2026 •

edited

Loading

github-actions Bot commented Mar 31, 2026 •

edited

Loading