akshay/add webhook to observatory backend #4572

Akkikens · 2025-12-31T03:27:03Z

integrate github-asana webhook service into observatory backend

integrates the webhook service as a route in the observatory backend, following slava's guidance to use eks instead of lambda.

changes:

webhook code moved to app_backend/src/metta/app_backend/github_webhook/
integrated as /webhooks/github route in server.py
fixes assignee resolution to use asana user GIDs instead of emails (fixes stale email issue)
adds secrets manager permissions to existing observatory-backend IRSA role
reuses existing docker image, helm chart, and IRSA role

required actions (after merge):

apply terraform changes in devops/tf/eks/observatory.tf via spacelift (adds secrets manager permissions to IRSA role)
verify github variables are set: vars.ASANA_WORKSPACE_GID, vars.ASANA_PROJECT_GID
code will auto-deploy via github actions after terraform is applied

endpoint after deployment: https://api.observatory.softmax-research.net/webhooks/github

Asana Task

- Move webhook code from webhook_service/ to app_backend/src/metta/app_backend/github_webhook/ - Update all imports to use new module path (metta.app_backend.github_webhook) - Integrate webhook router into server.py at /webhooks/github endpoint - Add asana dependency to app_backend/pyproject.toml - Remove Secrets Manager fallback for ASANA_WORKSPACE_GID and ASANA_PROJECT_GID (these should only come from environment variables) - Update build-app-backend-image.yml to pass GIDs from GitHub Variables via Helm The webhook endpoint will be available at: https://api.observatory.softmax-research.net/webhooks/github Environment variables required: - ASANA_WORKSPACE_GID (from GitHub Variables) - ASANA_PROJECT_GID (from GitHub Variables) - Other secrets loaded from AWS Secrets Manager via IRSA

Pass ASANA_WORKSPACE_GID and ASANA_PROJECT_GID from GitHub Variables to the Helm deployment via extra_args.

The webhook service needs Secrets Manager access when USE_AWS_SECRETS=true. This adds the required permissions to the existing observatory-backend role instead of creating a new role, following Slava's guidance to reuse existing infrastructure.

- Fix duplicate extra_args in workflow YAML (was causing invalid YAML) - Add USE_AWS_SECRETS=true to Helm deployment via extra_args - Update webhook signature verification to fail in production if secret missing (when USE_AWS_SECRETS=true but GITHUB_WEBHOOK_SECRET is None) - Document configuration requirements in values.yaml and README.md - Required GitHub Variables (ASANA_WORKSPACE_GID, ASANA_PROJECT_GID) - Required AWS Secrets Manager secrets - How env vars are set via Helm extra_args

- Remove empty __init__.py file (Nishad doesn't like empty files) - Remove verbose comments from values.yaml - Remove webhook documentation from README.md - Fix Terraform: keep 'policy' key name instead of changing to 's3_policy'

Resolves issue where stale email addresses in roster project cause task assignment failures. Now resolves GitHub login -> email (from roster) -> Asana user GID (from workspace users API) and uses GID for assignment. This prevents the 'Not a user in Organization' error when emails change (e.g., nishad@softmax.com -> nishad@stem.ai) because GIDs are stable. Fixes the issue mentioned in: https://github.com/Metta-AI/metta/actions/runs/20422510698/job/58676794680

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2025-12-31T03:29:35Z

app_backend/src/metta/app_backend/github_webhook/asana_integration.py

+    try:
+        import requests
+


Declare requests dependency for roster mapping

_get_github_to_asana_mapping imports requests, but app_backend/pyproject.toml does not list requests as a dependency, so in a fresh deploy this import raises ImportError, the mapping function returns {}, and every PR webhook runs without an Asana assignee even when the roster project is configured. Add the dependency so assignee resolution works in production.

Useful? React with 👍 / 👎.

graphite-app · 2025-12-31T03:30:21Z

app_backend/src/metta/app_backend/github_webhook/routes.py

+        hash_algorithm, github_signature = signature_header.split("=")
+        if hash_algorithm != "sha256":
+            return False


The split("=") will fail if signature_header doesn't contain "=". This would raise a ValueError: not enough values to unpack when unpacking into two variables.

if not signature_header or "=" not in signature_header: return False hash_algorithm, github_signature = signature_header.split("=", 1)

Suggested change

hash_algorithm, github_signature = signature_header.split("=")

if hash_algorithm != "sha256":

return False

if not signature_header or "=" not in signature_header:

return False

hash_algorithm, github_signature = signature_header.split("=", 1)

Spotted by Graphite Agent

Is this helpful? React 👍 or 👎 to let us know.

- add requests dependency (used by roster mapping) - fix signature verification to handle missing '=' in header - fix pyright type errors for asana API response handling

- include both webhook_router and tournament_router - add tournament_routes import

datadog-official · 2026-01-05T17:59:57Z

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: cef9d86 | Docs | Was this helpful? Give us feedback!}

graphite-app · 2026-01-05T18:00:06Z

app_backend/src/metta/app_backend/github_webhook/asana_integration.py

+        access_token = _get_asana_access_token()
+    except ValueError:
+        return {}
+
+    # Get roster project ID from settings
+    roster_project_gid = settings.ASANA_ROSTER_PROJECT_GID
+    gh_login_field_gid = settings.ASANA_GH_LOGIN_FIELD_GID
+    asana_email_field_gid = settings.ASANA_EMAIL_FIELD_GID
+
+    mapping = {}
+
+    try:
+        import requests
+
+        access_token = _get_asana_access_token()


Redundant API call: _get_asana_access_token() is called twice (lines 83 and 97) within the same try block. The first call on line 83 assigns to access_token but then line 97 immediately overwrites it.

# Remove line 83, keep only line 97 # Line 83 should be deleted: # access_token = _get_asana_access_token() # DELETE THIS

This causes unnecessary authentication overhead and potential rate limiting issues.

Suggested change

access_token = _get_asana_access_token()

except ValueError:

return {}

# Get roster project ID from settings

roster_project_gid = settings.ASANA_ROSTER_PROJECT_GID

gh_login_field_gid = settings.ASANA_GH_LOGIN_FIELD_GID

asana_email_field_gid = settings.ASANA_EMAIL_FIELD_GID

mapping = {}

try:

import requests

access_token = _get_asana_access_token()

try:

# Get roster project ID from settings

roster_project_gid = settings.ASANA_ROSTER_PROJECT_GID

gh_login_field_gid = settings.ASANA_GH_LOGIN_FIELD_GID

asana_email_field_gid = settings.ASANA_EMAIL_FIELD_GID

mapping = {}

import requests

access_token = _get_asana_access_token()

Spotted by Graphite Agent

Is this helpful? React 👍 or 👎 to let us know.

- fix task creation failure handling: return error plan instead of success when creation fails - fix GitHub URL field config: use settings.ASANA_GITHUB_URL_FIELD_ID instead of os.getenv - fix blocking HTTP calls: run Asana SDK and requests calls in ThreadPoolExecutor to avoid blocking event loop - add metrics for signature verification failures

- make _get_github_to_asana_mapping async (was using await in sync function) - fix all executor leaks with try/finally blocks - ensure executors are always shut down even on exceptions

webhook config Settings class was rejecting fields from .env that belong to the main app_backend config. added extra='ignore' to allow these.

github times out after 10s if webhook doesn't respond quickly. return response immediately and process event in background to avoid timeouts.

Akkikens added 6 commits December 30, 2025 21:33

Add ASANA GIDs to observatory backend deployment

13691ae

Pass ASANA_WORKSPACE_GID and ASANA_PROJECT_GID from GitHub Variables to the Helm deployment via extra_args.

github-actions bot assigned Akkikens Dec 31, 2025

chatgpt-codex-connector bot reviewed Dec 31, 2025

View reviewed changes

graphite-app bot reviewed Dec 31, 2025

View reviewed changes

Akkikens added 3 commits December 31, 2025 00:18

fix code review issues

ff33f1e

- add requests dependency (used by roster mapping) - fix signature verification to handle missing '=' in header - fix pyright type errors for asana API response handling

merge main: resolve conflict with tournament routes

0f6c350

- include both webhook_router and tournament_router - add tournament_routes import

fix terraform: use s3_policy key instead of policy

bf463f1

graphite-app bot reviewed Jan 5, 2026

View reviewed changes

Akkikens mentioned this pull request Jan 5, 2026

Akshay/GitHub asana webhook sync #4481

Closed

Akkikens added 4 commits January 5, 2026 10:14

fix critical syntax error and executor leaks

9ac0a53

- make _get_github_to_asana_mapping async (was using await in sync function) - fix all executor leaks with try/finally blocks - ensure executors are always shut down even on exceptions

fix config: allow extra fields to ignore HOST/PORT/STATS_DB_URI

822bd37

webhook config Settings class was rejecting fields from .env that belong to the main app_backend config. added extra='ignore' to allow these.

fix webhook timeout: return response immediately, process async

cef9d86

github times out after 10s if webhook doesn't respond quickly. return response immediately and process event in background to avoid timeouts.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

akshay/add webhook to observatory backend #4572

akshay/add webhook to observatory backend #4572

Akkikens commented Dec 31, 2025 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Dec 31, 2025

Uh oh!

graphite-app bot Dec 31, 2025

Uh oh!

datadog-official bot commented Jan 5, 2026 •

edited

Loading

Uh oh!

graphite-app bot Jan 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

akshay/add webhook to observatory backend #4572

Are you sure you want to change the base?

akshay/add webhook to observatory backend #4572

Conversation

Akkikens commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

graphite-app bot Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

datadog-official bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

graphite-app bot Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Akkikens commented Dec 31, 2025 •

edited

Loading

datadog-official bot commented Jan 5, 2026 •

edited

Loading