Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

github-events: Add WEBHOOK_ID and REQUESTED_ONLY_WEBHOOK_ID filters #689

Merged
merged 1 commit into from
Jan 13, 2025

Conversation

wlynch
Copy link
Member

@wlynch wlynch commented Jan 11, 2025

Adds an option to only listen to check_run only webhook events for specific webhooks.

In our current deployment, we have multiple webhooks that funnel into the trampoline from multiple sources. Some are repo-level webhooks, some are org-level webhooks. We want to move to a model where we route all of these through a GitHub App, but to do this without downtime or sending duplicate events is tricky. This aims to solve this by restricting a specific webhook to only events that are unique to GitHub Apps - requested check_{run,suite} events.

This will allow us to rollout the new webhook but only pass through these specific events. Once we verify they work, then we can ignore the old webhooks and fully trust the new webhook all in one deployment.

  1. WEBHOOK_ID=nil REQUESTED_ONLY_WEBHOOK_ID=nil | Receive all events
  2. WEBHOOK_ID=nil REQUESTED_ONLY_WEBHOOK_ID=1 | Receive all events except from webhook 1, and only request checks from webhook 1
  3. Start sending events from webhook 1
  4. WEBHOOK_ID=1 REQUEST_ONLY_WEBHOOK_ID=nil | Only receive events from webhook 1
  5. Stop sending events from all other webhooks.

If there are any problems, we can safely rollback the release since the configs are contained here.

Adds an option to only listen to check_run only webhook events for
specific webhooks.

In our current deployment, we have multiple webhooks that funnel into
the trampoline from multiple sources. Some are repo-level webhooks, some
are org-level webhooks. We want to move to a model where we route all of
these through a GitHub App, but to do this without downtime or sending
duplicate events is tricky. This aims to solve this by restricting
a specific webhook to only events that are unique to GitHub Apps -
requested check_{run,suite} events.

This will allow us to rollout the new webhook but only pass through
these specific events. Once we verify they work, then we can ignore the
old webhooks and fully trust the new webhook all in one deployment.

1. WEBHOOK_ID=nil REQUESTED_ONLY_WEBHOOK_ID=nil | Receive all events
2. WEBHOOK_ID=nil REQUESTED_ONLY_WEBHOOK_ID=1 | Receive all events
   except from webhook 1, and only request checks from webhook 1
3. Start sending events from webhook 1
4. WEBHOOK_ID=1 REQUEST_ONLY_WEBHOOK_ID=nil | Only receive events from
   webhook 1
5. Stop sending events from all other webhooks.

If there are any problems, we can safely rollback the release since the
configs are contained here.
@wlynch wlynch requested a review from imjasonh January 11, 2025 03:45
@wlynch wlynch changed the title github-events: Add REQUESTED_ONLY_WEBHOOK_ID filter. github-events: Add WEBHOOK_ID and REQUESTED_ONLY_WEBHOOK_ID filters Jan 11, 2025
@wlynch wlynch merged commit 33b4f50 into chainguard-dev:main Jan 13, 2025
85 checks passed
wlynch added a commit that referenced this pull request Jan 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants