Rename groups to streams, add group config, and add /github/skipper route

Routes are now named skipper_stream and skjs_stream to reflect they target
streams. Introduces a groups config section with a skipper group, and a
new /github/skipper route that references it. Also improves webhook
signature validation logging with route name and signature details.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Author: hubyrod

config.ts

@@ -7,13 +7,22 @@ const config: SkiphooksConfig = {
   slashwork: {
     graphqlUrl: process.env.SLASHWORK_GRAPHQL_URL!,
   },
+  groups: {
+    skipper: {
+      id: "https://skiplabs.slashwork.com/stream/g_dUYLNrxW7GzSxQwCKfGGQL",
+      authToken: process.env.SLASHWORK_AUTH_TOKEN_SKIPPER!,
+    },
+  },
   routes: {
     skipper: {
-      groupId: "g_dUYLNrxW7GzSxQwCKfGGQL",
+      group: "skipper",
+    },
+    skipper_stream: {
+      streamId: "g_dUYLNrxW7GzSxQwCKfGGQL",
       authToken: process.env.SLASHWORK_AUTH_TOKEN_SKIPPER!,
     },
-    skjs: {
-      groupId: "g_dUYLNrxW7GzSxQwCKfGGQL",
+    skjs_stream: {
+      streamId: "g_dUYLNrxW7GzSxQwCKfGGQL",
       authToken: process.env.SLASHWORK_AUTH_TOKEN_SKJS!,
     },
   },

src/config.ts

@@ -1,7 +1,18 @@
 export type EventType = "pull_request" | "issues" | "issue_comment" | "push" | "release";
 
-export interface RouteConfig {
-  groupId: string;
+export interface StreamRouteConfig {
+  streamId: string;
+  authToken: string;
+}
+
+export interface GroupRouteConfig {
+  group: string;
+}
+
+export type RouteConfig = StreamRouteConfig | GroupRouteConfig;
+
+export interface GroupConfig {
+  id: string;
   authToken: string;
 }
 
@@ -12,6 +23,7 @@ export interface SkiphooksConfig {
   slashwork: {
     graphqlUrl: string;
   };
+  groups?: Record<string, GroupConfig>;
   routes: Record<string, RouteConfig>;
 }
 
@@ -31,12 +43,29 @@ export function loadConfig(): SkiphooksConfig {
     throw new Error("config: at least one route must be configured");
   }
 
-  for (const [name, route] of Object.entries(config.routes)) {
-    if (!route?.groupId) {
-      throw new Error(`config: routes.${name}.groupId is required`);
+  if (config.groups) {
+    for (const [name, group] of Object.entries(config.groups)) {
+      if (!group?.id) {
+        throw new Error(`config: groups.${name}.id is required`);
+      }
+      if (!group?.authToken) {
+        throw new Error(`config: groups.${name}.authToken is required`);
+      }
     }
-    if (!route?.authToken) {
-      throw new Error(`config: routes.${name}.authToken is required`);
+  }
+
+  for (const [name, route] of Object.entries(config.routes)) {
+    if ("group" in route) {
+      if (!config.groups?.[route.group]) {
+        throw new Error(`config: routes.${name}.group references unknown group "${route.group}"`);
+      }
+    } else {
+      if (!route?.streamId) {
+        throw new Error(`config: routes.${name}.streamId is required`);
+      }
+      if (!route?.authToken) {
+        throw new Error(`config: routes.${name}.authToken is required`);
+      }
     }
   }
 

src/index.ts

@@ -11,11 +11,20 @@ import { releaseHandler } from "./handlers/release.ts";
 const config = loadConfig();
 const port = parseInt(process.env.PORT || "3000", 10);
 
-function connectionForRoute(routeName: string): SlashworkConnection {
+function resolveRoute(routeName: string): { targetId: string; authToken: string } {
   const route = config.routes[routeName]!;
+  if ("group" in route) {
+    const group = config.groups![route.group]!;
+    return { targetId: group.id, authToken: group.authToken };
+  }
+  return { targetId: route.streamId, authToken: route.authToken };
+}
+
+function connectionForRoute(routeName: string): SlashworkConnection {
+  const { authToken } = resolveRoute(routeName);
   return {
     graphqlUrl: config.slashwork.graphqlUrl,
-    authToken: route.authToken,
+    authToken,
   };
 }
 
@@ -32,7 +41,7 @@ function log(level: string, message: string) {
 }
 
 async function handleWebhook(req: Request, routeName: string): Promise<Response> {
-  const route = config.routes[routeName]!;
+  const { targetId } = resolveRoute(routeName);
   const connection = connectionForRoute(routeName);
   if (req.method !== "POST") {
     return new Response("Method not allowed", { status: 405 });
@@ -47,7 +56,7 @@ async function handleWebhook(req: Request, routeName: string): Promise<Response>
 
   const signature = req.headers.get("x-hub-signature-256");
   if (!verifySignature(body, signature, config.github.webhookSecret)) {
-    log("warn", "Invalid webhook signature");
+    log("warn", `Invalid webhook signature for route "${routeName}" (signature: ${signature ? `"${signature.slice(0, 20)}..."` : "missing"}, body length: ${body.length})`);
     return new Response("Invalid signature", { status: 401 });
   }
 
@@ -81,7 +90,7 @@ async function handleWebhook(req: Request, routeName: string): Promise<Response>
 
   try {
     const { markdown } = handler.format(payload);
-    await postToSlashwork(connection, route.groupId, markdown);
+    await postToSlashwork(connection, targetId, markdown);
     log("info", `Posted ${eventType} event: ${payload.action ?? "n/a"}`);
   } catch (err) {
     log("error", `Failed to post to Slashwork: ${err}`);

src/slashwork.ts

@@ -47,7 +47,7 @@ export async function validateConnection(
 
 export async function postToSlashwork(
   connection: SlashworkConnection,
-  groupId: string,
+  streamId: string,
   markdown: string,
 ): Promise<void> {
   const response = await fetch(connection.graphqlUrl, {
@@ -59,7 +59,7 @@ export async function postToSlashwork(
     body: JSON.stringify({
       query: CREATE_POST_MUTATION,
       variables: {
-        groupId,
+        groupId: streamId,
         markdown,
       },
     }),

test-webhook.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 GITHUB_WEBHOOK_SECRET=f637d855c345d8e2f50ebf51de5480d3fa99e8b3af636aa5824ffdcfa4e3a58c
 
-ROUTE="${1:-skipper}"
+ROUTE="${1:-skipper_stream}"
 BASE_URL="${2:-https://app-e18aa250-0ebc-4a2d-ba9f-1383450de63c.cleverapps.io}"
 URL="${BASE_URL}/github/${ROUTE}"
 SECRET="${GITHUB_WEBHOOK_SECRET:?Set GITHUB_WEBHOOK_SECRET env var}"