Register webhook and script in create PR command by richardhjtan · Pull Request #3998 · cardstack/boxel

richardhjtan · 2026-02-14T04:41:50Z

GitHub Webhook Setup for Local Testing

Quick guide for testing webhooks locally with ngrok.

Quick Start

1. Start ngrok

ngrok http 4201

Copy the URL from output: https://abc123.ngrok.io

⚠️ Free ngrok URL changes each restart - you'll need to update GitHub webhook URL

2. Register webhook

cd packages/matrix
PUBLIC_URL=https://abc123.ngrok.io \
MATRIX_USERNAME=@admin:localhost \
MATRIX_PASSWORD=password \
pnpm exec ts-node scripts/register-github-webhook.ts

Copy the webhook URL and signing secret from output.

3. Add to GitHub

Go to your repo → Settings → Webhooks → Add webhook
URL: (paste from script output)
Secret: (paste from script output)
Content type: application/json
Events: Select "Pull requests" and "Pull request reviews"
Click "Add webhook"

4. Test

Create a PR or use GitHub's webhook test feature to verify it works.

When ngrok Restarts (URL Changed)

# 1. Get new ngrok URL
# 2. Re-run script from packages/matrix
cd packages/matrix
PUBLIC_URL=https://NEW_URL.ngrok.io pnpm exec ts-node scripts/register-github-webhook.ts

# 3. Update GitHub webhook:
#    Settings → Webhooks → Edit → Change URL → Update
#    (Keep the same secret - script reuses it)

Troubleshooting

Webhooks not working after ngrok restart?

→ ngrok URL changed. Re-run script and update URL in GitHub.

Getting 401 errors?

→ Verify signing secret in GitHub matches the script output.

Webhooks not received?

# Check ngrok is running
curl http://localhost:4040/api/tunnels

# Check realm server is running
curl http://localhost:4201/_health

Monitor webhook deliveries

ngrok dashboard: http://localhost:4040
GitHub: Repo → Settings → Webhooks → Recent Deliveries

For more details, see GitHub Webhooks Documentation.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e1b34cd1f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

packages/host/app/commands/create-listing-pr.ts

github-actions · 2026-02-14T04:49:38Z

Preview deployments

github-actions · 2026-02-14T05:01:43Z

Host Test Results

1 files ±0 1 suites ±0 1h 38m 42s ⏱️ + 4m 52s
1 886 tests +7 1 871 ✅ +7 15 💤 ±0 0 ❌ ±0
1 901 runs +7 1 886 ✅ +7 15 💤 ±0 0 ❌ ±0

Results for commit 500702b. ± Comparison against base commit 61ceac3.

This pull request removes 1 and adds 8 tests. Note that renamed tests count towards both.

Chrome ‑ Acceptance | code submode | create-file tests > when user has permissions to both test realms: new file button has options to create card def, field def, card instance, and text files

Chrome ‑ Acceptance | code submode | create-file tests > when user has permissions to both test realms: can upload a file via the New menu
Chrome ‑ Acceptance | code submode | create-file tests > when user has permissions to both test realms: cancelling upload file picker does not cause errors
Chrome ‑ Acceptance | code submode | create-file tests > when user has permissions to both test realms: new file button has options to create card def, field def, card instance, text files, and upload file
Chrome ‑ Acceptance | code submode | file-tree tests > when the user lacks write permissions: file tree does not show context menu in read-only realm
Chrome ‑ Acceptance | code submode | file-tree tests: can cancel delete from file tree context menu
Chrome ‑ Acceptance | code submode | file-tree tests: can delete a file from file tree context menu
Chrome ‑ Acceptance | code submode | file-tree tests: can delete a file via right-click in file tree
Chrome ‑ Acceptance | file chooser tests: uploading a file without an extension shows an error

♻️ This comment has been updated with latest results.

Copilot

Pull request overview

This pull request adds webhook registration functionality to enable GitHub webhook notifications for pull requests. The implementation includes infrastructure for creating and managing incoming webhooks, filtering webhook commands by event type and PR number, and a script for easy webhook setup during local development with ngrok.

Changes:

Added webhook registration capability to the create-listing-pr command to automatically set up GitHub webhooks for PR status updates
Implemented command filtering logic in the webhook receiver to filter by event type and PR number
Created a standalone script for manual webhook registration with idempotent behavior

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/runtime-common/pr-manifest.ts	Adds webhook metadata (id, path, signingSecret) to PrManifest interface
packages/realm-server/handlers/handle-webhook-receiver.ts	Implements webhook command lookup and filtering by event type and PR number
packages/realm-server/tests/server-endpoints/webhook-receiver-test.ts	Adds comprehensive tests for command execution and filtering scenarios
packages/matrix/scripts/register-github-webhook.ts	New script for registering GitHub webhooks with idempotent behavior
packages/host/app/services/realm-server.ts	Adds service methods for creating webhooks and webhook commands
packages/host/app/commands/create-listing-pr.ts	Integrates webhook registration into PR creation flow

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/host/app/commands/create-listing-pr.ts

Copilot · 2026-02-16T15:01:41Z

packages/runtime-common/pr-manifest.ts

+  webhook?: {
+    id: string;              // UUID from incoming_webhooks table
+    path: string;            // webhook_path (e.g., "whk_abc123...")
+    signingSecret: string;   // For GitHub webhook configuration


The signing secret is sensitive information used to verify GitHub webhook signatures. Storing it in the PrManifest may pose a security risk if this manifest is persisted or exposed through any API endpoints. Consider whether the signing secret needs to be stored in the manifest at all - it may be sufficient to only store the webhook ID and path, and retrieve the signing secret from the database when needed for configuration purposes. If the manifest is only used transiently and never persisted or exposed, this is acceptable, but the comment "Store minimal manifest in room state" suggests it may be stored.

Suggested change

signingSecret: string; // For GitHub webhook configuration

signingSecretId: string; // Reference/ID for secret used to verify GitHub webhooks (not the raw secret)

Copilot · 2026-02-16T15:01:41Z

packages/matrix/scripts/register-github-webhook.ts

+const webhookConfig = {
+  verificationType: 'HMAC_SHA256_HEADER' as const,
+  verificationConfig: {
+    header: 'x-hub-signature-256',


The header name should be 'X-Hub-Signature-256' with capital letters instead of 'x-hub-signature-256'. While HTTP headers are case-insensitive, the verification logic in handle-webhook-receiver.ts normalizes headers to lowercase before comparison (line 178), but the GitHub API documentation and all existing tests in the codebase consistently use 'X-Hub-Signature-256' with capital letters. This inconsistency could cause confusion and should be corrected for consistency with the rest of the codebase.

Suggested change

header: 'x-hub-signature-256',

header: 'X-Hub-Signature-256',

packages/host/app/commands/create-listing-pr.ts

richardhjtan requested review from a team and tintinthong February 14, 2026 04:42

chatgpt-codex-connector bot reviewed Feb 14, 2026

View reviewed changes

packages/host/app/commands/create-listing-pr.ts Outdated Show resolved Hide resolved

habdelra requested a review from Copilot February 16, 2026 14:56

Copilot started reviewing on behalf of habdelra February 16, 2026 14:57 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

richardhjtan force-pushed the CS-10190-register-webhook-in-create-pr-command branch 3 times, most recently from 64d9e7e to 9f276e7 Compare February 24, 2026 13:23

Register webhook and script in create PR command

acb7522

richardhjtan force-pushed the CS-10190-register-webhook-in-create-pr-command branch from 9f276e7 to acb7522 Compare February 24, 2026 13:23

Clean up register webhook script

172fcd6

richardhjtan force-pushed the CS-10190-register-webhook-in-create-pr-command branch from c1e3cf9 to 172fcd6 Compare February 26, 2026 07:06

Fix lint

500702b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Register webhook and script in create PR command#3998

Register webhook and script in create PR command#3998
richardhjtan wants to merge 3 commits intomainfrom
CS-10190-register-webhook-in-create-pr-command

richardhjtan commented Feb 14, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	signingSecret: string; // For GitHub webhook configuration
	signingSecretId: string; // Reference/ID for secret used to verify GitHub webhooks (not the raw secret)

	header: 'x-hub-signature-256',
	header: 'X-Hub-Signature-256',

Conversation

richardhjtan commented Feb 14, 2026

GitHub Webhook Setup for Local Testing

Quick Start

1. Start ngrok

2. Register webhook

3. Add to GitHub

4. Test

When ngrok Restarts (URL Changed)

Troubleshooting

Webhooks not working after ngrok restart?

Getting 401 errors?

Webhooks not received?

Monitor webhook deliveries

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

github-actions bot commented Feb 14, 2026

Preview deployments

Uh oh!

github-actions bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Host Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Feb 14, 2026 •

edited

Loading