Linear-integration by SeanJA239 · Pull Request #11 · arcboxlabs/larkstack

SeanJA239 · 2026-03-09T07:48:26Z

Later updates for linear integration will be updated here.

Copilot

Pull request overview

This PR expands the webhook/notification pipeline beyond Linear by adding GitHub webhook ingestion and X/Twitter link previews, along with related Lark sink updates, debounce improvements, and deployment/CI configuration updates.

Changes:

Add a GitHub webhook source that verifies signatures, normalizes events into the unified Event model, and dispatches to Lark (including optional DMs).
Add X/Twitter link preview support in the Lark event handler, including optional decryption for encrypted Lark callback payloads.
Add a max-wait cap to debounce behavior (native + Durable Object) and update Cloudflare Workers build/deploy settings.

Reviewed changes

Copilot reviewed 27 out of 29 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`wrangler.toml`	Updates Worker build command, debounce defaults, migrations, and observability settings.
`tests/fixtures/github_pr_opened.json`	Adds a GitHub webhook fixture payload for testing/dev.
`src/utils.rs`	Adds shared HMAC-SHA256 verification helper.
`src/sources/x/mod.rs`	Introduces X/Twitter client + URL parsing + multi-source fetch fallback.
`src/sources/mod.rs`	Exposes new `github` and `x` sources.
`src/sources/linear/utils.rs`	Reuses shared HMAC verifier; improves status change messaging.
`src/sources/linear/models.rs`	Extends `UpdatedFrom` to support `state_id`-only payloads.
`src/sources/linear/handler.rs`	Threads debounce delay/max-wait into debounce scheduling + payload.
`src/sources/github/utils.rs`	Adds GitHub signature header parsing and HMAC delegation.
`src/sources/github/mod.rs`	Wires GitHub source module exports.
`src/sources/github/handler.rs`	Implements GitHub webhook handler (native via octocrab, CF via thin structs).
`src/sinks/lark/mod.rs`	Splits Linear vs GitHub webhook notifications; refines DM logic.
`src/sinks/lark/event_handler.rs`	Adds encrypted payload support + routes link previews to X or Linear.
`src/sinks/lark/cards.rs`	Adds GitHub card builders + X preview card builder; refactors shared helpers.
`src/sinks/lark/bot.rs`	Refactors bot API calls into typed request/response structs; adds chat send helper.
`src/main.rs`	Adds `/github/webhook` route for native server.
`src/lib.rs`	Adds `/github/webhook` routing for CF Worker entrypoint.
`src/event.rs`	Extends `Event` enum with GitHub event variants and commit summaries.
`src/dispatch.rs`	Adds dedicated GitHub dispatch path (separate webhook + bot fallback).
`src/debounce_do.rs`	Adds max-wait enforcement in DO debounce + improved webhook/DM sending.
`src/debounce.rs`	Adds max-wait enforcement for in-memory debounce and returns actual delay.
`src/config.rs`	Adds GitHub config, X client, multiple Lark webhook/bot configs, and debounce max-wait config.
`invocation-log.json`	Adds a runtime invocation log artifact.
`Cargo.toml`	Adds deps for octocrab (native), AES-CBC decrypt, base64.
`Cargo.lock`	Locks new dependencies introduced by the PR.
`.wrangler/cache/wrangler-account.json`	Adds Wrangler local cache artifact containing account metadata.
`.gitignore`	Ignores additional local/dev artifacts including `.wrangler/`.
`.github/workflows/deploy.yml`	Adds GitHub Actions workflow to deploy to Cloudflare Workers on `main`.
`.github/workflows/ci.yml`	Adjusts clippy invocation in CI.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-09T07:53:17Z

+    let computed = hex::encode(mac.finalize().into_bytes());
+    computed == expected_hex


verify_hmac_sha256 compares the computed and expected MAC using normal string equality, which is not constant-time and also ties verification to a specific hex formatting (case, leading zeros). Prefer decoding expected_hex to raw bytes and using the HMAC crate’s constant-time verification (e.g., verify_slice) so signature checks are timing-safe and format-robust.

Suggested change

let computed = hex::encode(mac.finalize().into_bytes());

computed == expected_hex

let Ok(expected_bytes) = hex::decode(expected_hex) else {

return false;

};

let result = mac.finalize();

result.verify_slice(&expected_bytes).is_ok()

Copilot · 2026-03-09T07:53:18Z

-    }));
+    if !tweet.text.is_empty() {
+        elements.push(json!({
+            "tag": "markdown",


build_x_preview_card adds an element with { "tag": "markdown" }, while the rest of the code builds interactive cards using div + lark_md. If Lark interactive cards don’t support a top-level markdown element, this preview card will render incorrectly or be rejected. Consider using the existing md_div(...) helper (or whichever element type Lark expects) for tweet text to keep the card schema consistent.

Suggested change

"tag": "markdown",

"tag": "div",

"lark_md": true,

Copilot · 2026-03-09T07:53:18Z

+    async fn fetch_oembed(&self, tweet_url: &str) -> Result<TweetData, String> {
+        let url = format!(
+            "https://publish.twitter.com/oembed?url={}&omit_script=true",
+            tweet_url
+        );


fetch_oembed interpolates tweet_url directly into the url= query parameter without percent-encoding. Real tweet URLs often contain ?/& query strings, which will break the oEmbed request (or change its semantics). Encode tweet_url before building the request URL (e.g., via url::form_urlencoded / percent-encoding) so the fallback works reliably.

Copilot · 2026-03-09T07:53:18Z

+        .route(
+            "/github/webhook",
+            post(larkstack::sources::github::webhook_handler),
+        )


PR title/description mention only “Linear integration” updates, but this change set also adds a full GitHub webhook source, X/Twitter link previews, new CI/deploy workflows, and Lark encryption handling. Please update the PR title/description to reflect the actual scope so reviewers/operators can assess impact correctly.

Copilot · 2026-03-09T07:53:19Z

+        if let Some(email) = &dm_email {
            let app_id = self.env.var("LARK_APP_ID").ok().map(|v| v.to_string());
            let app_secret = self
                .env
                .secret("LARK_APP_SECRET")
                .ok()


In the Durable Object alarm path, LARK_APP_ID is read via env.var("LARK_APP_ID"), but LarkConfig::from_worker_env reads LARK_APP_ID via env.secret("LARK_APP_ID"). With the current setup, one side will fail depending on how the Worker env var is configured, and Linear DMs may silently stop working. Align these to use the same mechanism (prefer secret(...) for credentials).

Copilot · 2026-03-09T07:53:19Z

          components: clippy
      - uses: Swatinem/rust-cache@v2
-      - run: cargo clippy --all-targets --all-features -- -D warnings
+      - run: cargo clippy --all-targets -- -D warnings


CI clippy no longer runs with --all-features. Since this repo has feature-gated targets (native vs cf-worker), dropping --all-features can let feature-specific compilation/lint issues slip through (notably for the Cloudflare Worker build). Consider adding a second clippy step for --no-default-features --features cf-worker or re-enabling --all-features.

Suggested change

- run: cargo clippy --all-targets -- -D warnings

- name: Clippy (default features)

run: cargo clippy --all-targets -- -D warnings

- name: Clippy (cf-worker features)

run: cargo clippy --all-targets --no-default-features --features cf-worker -- -D warnings

Copilot · 2026-03-09T07:53:19Z

+{
+    "level": "info",
+    "message": "POST https://larkstack.arcbox.workers.dev/lark/event",
+    "$workers": {
+        "event": {
+            "request": {


This invocation log appears to be an environment-generated diagnostic artifact and includes detailed request metadata. It shouldn’t be committed to the repo; please remove it and add it to .gitignore to avoid leaking operational details and noisy diffs in future PRs.

Copilot · 2026-03-09T07:53:19Z

+  "account": {
+    "id": "35fd6722a9c33a03ec19dc5ed74771bc",
+    "name": "ArcBox Labs"
+  }


This file contains a Cloudflare account id/name and is under .wrangler/cache/, which is typically local, auto-generated state. It should not be committed; please remove it from the repo (and ensure .wrangler/ stays ignored, as in the updated .gitignore).

Suggested change

"account": {

"id": "35fd6722a9c33a03ec19dc5ed74771bc",

"name": "ArcBox Labs"

}

- Introduced octocrab models for type-safe GitHub webhook handling - Replaced json!() macros with proper struct serialization refactor: introduced octocrab models for Github webhook

…te card feat: X link preview with fxtwitter, AES decryption, and card improvements - Add fxtwitter.com as primary tweet source (no auth, rich metrics) - Add AES-256-CBC decryption for encrypted Lark payloads (LARK_X_ENCRYPT_KEY) - Support separate verification tokens for Linear and X Lark apps - Show tweet text, likes, and retweets in X preview card - Fix metrics condition to show counts even when only one metric is present - Truncate inline title to 30 chars (better for CJK text) - Add like_count, retweet_count, reply_count to TweetData - Enable CF Workers observability in wrangler.toml

…fication

…es in card

Copilot

Pull request overview

Copilot reviewed 42 out of 48 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

+pub fn verify_hmac_sha256(secret: &str, body: &[u8], expected_hex: &str) -> bool {
    let Ok(mut mac) = Hmac::<Sha256>::new_from_slice(secret.as_bytes()) else {
        return false;
    };
    mac.update(body);
-    let expected = hex::encode(mac.finalize().into_bytes());
-    expected == signature
-}
-
-// ---------------------------------------------------------------------------
-// Priority helpers
-// ---------------------------------------------------------------------------
-
-pub fn priority_color(priority: u8) -> &'static str {
-    match priority {
-        1 => "red",
-        2 => "orange",
-        3 => "yellow",
-        _ => "blue", // 0 (No priority) and 4 (Low)
-    }
+    let computed = hex::encode(mac.finalize().into_bytes());
+    computed == expected_hex


+    // Extract repo name and full_name in one pass (used for whitelist + display).
+    let (repo, repo_name) = match serde_json::from_slice::<RepoProbe>(&body) {
+        Ok(probe) => {
+            let full = probe
+                .repository
+                .full_name
+                .clone()
+                .unwrap_or_else(|| probe.repository.name.clone());
+            (full, probe.repository.name)
+        }
+        Err(_) => {
+            warn!("could not extract repository name from payload");
+            (String::new(), String::new())
+        }
+    };
+
+    if !github.repo_whitelist.is_empty()
+        && !repo_name.is_empty()
+        && !github.repo_whitelist.contains(&repo_name)
+    {
+        info!("ignoring event from non-whitelisted repo: {repo_name}");
+        return StatusCode::OK;
+    }


+        // Send DM via the Linear DM bot (enterprise self-built app).
+        if let Some(email) = &dm_email {
+            let app_id = self.env.var("LARK_APP_ID").ok().map(|v| v.to_string());
+            let app_secret = self
+                .env
+                .secret("LARK_APP_SECRET")
+                .ok()
+                .map(|s| s.to_string());
+            if let (Some(id), Some(secret)) = (app_id, app_secret) {
+                let bot = crate::sinks::lark::LarkBotClient::new(id, secret, http.clone());


+/// Extracts `(username, tweet_id)` from an X or Twitter URL.
+///
+/// Handles `https://x.com/user/status/1234567890` and
+/// `https://twitter.com/user/status/1234567890`.
+pub fn extract_tweet_info(url: &str) -> Option<(&str, &str)> {
+    let parts: Vec<&str> = url.split('/').collect();
+    for (i, &part) in parts.iter().enumerate() {
+        if part == "status" {
+            let id = parts.get(i + 1).copied()?;
+            let id = id.split('?').next().unwrap_or(id);
+            let id = id.split('#').next().unwrap_or(id);
+            if !id.is_empty() && id.chars().all(|c| c.is_ascii_digit()) {
+                let username = parts.get(i.wrapping_sub(1)).copied().unwrap_or("");
+                return Some((username, id));
+            }


+            );
+        }
+    }
+
+    info!("lark event received: {body_value}");
+
+    let event_type = body_value


+| `LINEAR_API_KEY` | Optional | GraphQL API access — enables link previews |
+| `LARK_VERIFICATION_TOKEN` | Optional | Lark event callback verification |
+| `PORT` | No | Listen port, defaults to `3000` (ignored on CF Workers) |
+| `DEBOUNCE_DELAY_MS` | No | Debounce window in ms, defaults to `5000` |


- Replace note/plain_text with md_div for X preview metrics so emoji (❤️ 🔁) render correctly in Lark - Fix repo whitelist check to also reject events when repo name cannot be extracted from payload (was previously bypassed on parse failure)

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

SeanJA239 requested a review from Copilot March 9, 2026 07:48

Copilot started reviewing on behalf of SeanJA239 March 9, 2026 07:48 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

SeanJA239 force-pushed the linear branch from 9e33d8e to 14c1b73 Compare March 9, 2026 10:35

SeanJA239 added 11 commits March 13, 2026 22:33

feat(github): add webhook integration with octocrab models

4b07699

- Introduced octocrab models for type-safe GitHub webhook handling - Replaced json!() macros with proper struct serialization refactor: introduced octocrab models for Github webhook

style(lint): fix clippy warnings for match ergonomics

618a960

config: sqlite class and octocrab

586be82

ci: removed --all-feature

0713a51

feat: seperate lark apps configuration

33285d1

feat: disable push notifications to prevent Lark group spam

3d1624f

cd: CF deployment

56b8776

feat: x/twitter link preview

d0d7dd0

feat(linear): longer debounce and introduce max_wait() to ensure noti…

4c7cede

…fication

feat(linear): store metrics status in workflow_states for event updat…

1453316

…es in card

SeanJA239 force-pushed the linear branch from 14c1b73 to 1453316 Compare March 13, 2026 15:26

SeanJA239 requested a review from Copilot March 14, 2026 02:30

Copilot started reviewing on behalf of SeanJA239 March 14, 2026 02:30 View session

Copilot AI reviewed Mar 14, 2026

View reviewed changes

greptile-apps Bot reviewed Apr 30, 2026

View reviewed changes

AprilNEA force-pushed the main branch from 8c2ea26 to 28acf84 Compare May 25, 2026 10:00

AprilNEA closed this Jun 14, 2026

AprilNEA deleted the linear branch June 14, 2026 12:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Linear-integration#11

Linear-integration#11
SeanJA239 wants to merge 12 commits into
mainfrom
linear

SeanJA239 commented Mar 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

greptile-apps Bot left a comment

Uh oh!

greptile-apps Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		let computed = hex::encode(mac.finalize().into_bytes());
		computed == expected_hex

-      - run: cargo clippy --all-targets -- -D warnings
+      - name: Clippy (default features)
+        run: cargo clippy --all-targets -- -D warnings
+      - name: Clippy (cf-worker features)
+        run: cargo clippy --all-targets --no-default-features --features cf-worker -- -D warnings

Conversation

SeanJA239 commented Mar 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants