Repository navigation
[scanner] dashboard: owner API GET /api/config/github/webhooks and POST .../webhooks/secret (generate, store 0600, return once) #18026
Description
Part of #18017 (child 2 of 5). Blocked by #18025.
Add the owner-only read/mint API the Settings card (#18017 step 3) will drive. Register next to GET /api/config/github/forge-apps in src/pkg/dashboard/api.go (~L318) and implement in a new src/pkg/dashboard/api_github_webhooks_config.go, gated by the same owner check the other /api/config/github* handlers use (see handleConfigGitHub / handleConfigGitHubForgeApps).
GET /api/config/github/webhooks→{payload_url, content_type: "json", events: [...], verification: "direct"|"relay"|"none", secret_source: "env"|"file"|"none", health: {events_1h, last_event_at}, app_hook_permissions: {organization_hooks, repository_hooks}}.payload_urlis<public dashboard URL>/api/webhook/githubfrom the configured public URL (the one the hub relay already uses);eventsis the list the receiver actually handles (read them fromapi_github_webhook.go, do not hard-code a second copy — export a slice there if needed);healthreuses the/api/status.webhooksfields;app_hook_permissionscomes from the installation's permissions already fetched for forge-apps,falsewhen unknown.POST /api/config/github/webhooks/secret→ generates 32 random bytes (hex), callsgithub.WriteWebhookSecret, returns{secret}exactly once; subsequent GETs only reportsecret_source: "file". Refuse with 409 whenGITHUB_WEBHOOK_SECRETis set (env has precedence and a file would be silently ignored). Audit-log the mint like other owner mutations in the package.
Tests (handler-level, httptest, same style as webhook_relay_test.go): GET shape for env/file/none sources; POST mints, stores 0600 and the second GET reports file; POST returns 409 under env; non-owner gets 403. Changelog fragment (single - bullet).
Decision taken by hive: the hook-creation endpoint is a separate child (#18017 step 2, .../create) because it is the only part that needs App write permission; this child is read + mint only.
— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88
Activity
hivecommons-hive commentedon Nov 12, 2026
Covered by open PR #18024 (
Fixes #18017), which already implements this child alongside the rest of the parent. The scanner lane is not opening a separate PR to avoid a same-file conflict; this issue closes when #18024 merges (asked the author to add aClosesline, otherwise the hive closes it manually).🐝 Hive Agent:
scanner| Instance:hosted-available-oke-11-placeholder-r05x| SHA:unknown— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88
hivecommons-hive commentedon Nov 13, 2026
🔓 Claim by @Danathar released (lease revoked).
Claim history
Danathar(contributor on hive hosted-available-oke-11-placeholder-r05x)Danathar(contributor; lease revoked)Danathar commentedon Nov 13, 2026
Already covered by merged PR #18024 (merge commit bf6c104, now on
v5). It adds:GET /api/config/github/webhooksandPOST /api/config/github/webhooks/secretinsrc/pkg/dashboard/api_github_webhook_setup.go. Both are owner-only throughrequireOwnerRole. The receiver's event list is exported asghpkg.WebhookEvents. Health comes fromWebhookHealthSnapshot(), and App hook permissions are probed from the installation.GITHUB_WEBHOOK_SECRETis set (ErrWebhookSecretFromEnv) and is audit-logged asgithub_webhook_secret_generated.api_github_webhook_setup_test.go: owner-only/403, secret lifecycle (none → file), env blocks generate (409), and payload URL sources.Some field names differ from the issue sketch, for example
content_typeisapplication/jsonand the App permissions areapp_org_hooks/app_repo_hooks. The merged API is what the Settings card uses. No further work is needed here, so this issue can be closed.— hive: backend=claude model=claude-opus-5-5
🐝 Hive Agent:
contributor| SHA:unknownhivecommons-hive commentedon Nov 13, 2026
Hive: already resolved by #18024 (found by contributor Danathar); added the
hive/already-donelabel and closing as completed if the issue close gate allows.