Add GitHub integration for issue tracking and post actions

.env.example

@@ -109,6 +109,43 @@ DISCORD_PUBLIC_KEY=
 # OPTIONAL: OAuth redirect URL. Defaults to <API_URL>/discord/oauth/callback.
 DISCORD_OAUTH_REDIRECT_URL=
 
+# [[GITHUB APP INTEGRATION]]
+# These settings power the two-way GitHub issue integration and are separate
+# from GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET under SOCIAL AUTH, which are
+# used only for signing users into Feeblo.
+#
+# Create a GitHub App under GitHub Settings -> Developer settings -> GitHub
+# Apps. Give it repository permissions "Issues: Read and write" and
+# "Metadata: Read", subscribe it to the Issues event, and enable
+# "Request user authorization (OAuth) during installation". Leave every
+# value below empty to disable the GitHub integration.
+#
+# REQUIRED: Numeric App ID shown on the GitHub App's General page. This is not
+# the OAuth Client ID.
+GITHUB_INTEGRATION_APP_ID=
+# REQUIRED: URL-friendly app name from the public installation URL. For
+# https://github.com/apps/feeblo, the slug is "feeblo".
+GITHUB_INTEGRATION_APP_SLUG=
+# REQUIRED: Client ID and client secret from the GitHub App's General page.
+# They are used only during installation to verify that the current installer
+# can access the selected GitHub App installation. The temporary user token is
+# discarded and is never stored.
+GITHUB_INTEGRATION_CLIENT_ID=
+GITHUB_INTEGRATION_CLIENT_SECRET=
+# REQUIRED: PEM private key generated from the GitHub App's Private keys
+# section. Preserve the complete BEGIN/END lines and line breaks. In a secret
+# manager, store the PEM as a multiline secret rather than committing the
+# downloaded .pem file.
+GITHUB_INTEGRATION_PRIVATE_KEY=
+# REQUIRED: Random webhook secret configured identically on the GitHub App's
+# General page. GitHub signs the global App webhook with this value.
+# Generate one with: openssl rand -hex 32
+# Also register the fixed Feeblo endpoints in the GitHub App: the callback URL
+# <API_URL>/github/app/installations/callback and the webhook URL
+# <API_URL>/github/app/webhooks. Feeblo mounts both paths itself; there are no
+# override variables for them.
+GITHUB_INTEGRATION_WEBHOOK_SECRET=
+
 # [[BILLING]]
 # OPTIONAL: Enables Polar checkout, customer portal, and signed webhooks when
 # both credentials are configured. Use sandbox while testing.

apps/server/package.json

@@ -7,7 +7,8 @@
     "build": "dotenvx run -f ../../.env -- rolldown -c",
     "dev": "dotenvx run -f ../../.env -- tsx watch src/index.ts",
     "start": "dotenvx run -f ../../.env -- tsx src/index.ts",
-    "check-types": "tsc --noEmit"
+    "check-types": "tsc --noEmit",
+    "test": "vitest run"
   },
   "dependencies": {
     "@effect/platform-node": "catalog:",
@@ -18,6 +19,7 @@
     "@feeblo/id": "workspace:*",
     "@feeblo/integration-core": "workspace:*",
     "@feeblo/integration-discord": "workspace:*",
+    "@feeblo/integration-github": "workspace:*",
     "@feeblo/integration-webhook": "workspace:*",
     "@feeblo/transactional": "workspace:*",
     "@feeblo/utils": "workspace:*",
@@ -27,9 +29,11 @@
     "@feeblo/integration-slack": "workspace:*"
   },
   "devDependencies": {
+    "@effect/vitest": "catalog:",
     "@feeblo/config": "workspace:*",
     "rolldown": "catalog:",
     "tsx": "catalog:",
-    "typescript": "catalog:"
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }

apps/server/src/config.test.ts

@@ -9,6 +9,7 @@ import { ServerConfig } from "./config";
 const requiredServerEnvironment = {
   APP_ROOT_DOMAIN: "example.test",
   APP_URL: "https://example.test",
+  AUTH_ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef",
   API_URL: "https://api.example.test",
 };
 

apps/server/src/config.ts

@@ -4,6 +4,7 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
 import * as Schema from "effect/Schema";
 
 export class ServerConfig extends Context.Service<ServerConfig>()(
@@ -16,6 +17,44 @@ export class ServerConfig extends Context.Service<ServerConfig>()(
       const nodeEnv = yield* Config.string("NODE_ENV").pipe(
         Config.withDefault("development")
       );
+      const githubAppId = yield* Config.string(
+        "GITHUB_INTEGRATION_APP_ID"
+      ).pipe(Config.option, Effect.map(Option.getOrUndefined));
+      const githubAppSlug = yield* Config.string(
+        "GITHUB_INTEGRATION_APP_SLUG"
+      ).pipe(Config.option, Effect.map(Option.getOrUndefined));
+      const githubClientId = yield* Config.string(
+        "GITHUB_INTEGRATION_CLIENT_ID"
+      ).pipe(Config.option, Effect.map(Option.getOrUndefined));
+      const githubClientSecret = yield* Config.redacted(
+        "GITHUB_INTEGRATION_CLIENT_SECRET"
+      ).pipe(
+        Config.option,
+        Effect.map((value) => Option.getOrElse(value, () => Redacted.make("")))
+      );
+      const githubWebhookSecret = yield* Config.redacted(
+        "GITHUB_INTEGRATION_WEBHOOK_SECRET"
+      ).pipe(
+        Config.option,
+        Effect.map((value) => Option.getOrElse(value, () => Redacted.make("")))
+      );
+      const githubPrivateKey = yield* Config.redacted(
+        "GITHUB_INTEGRATION_PRIVATE_KEY"
+      ).pipe(
+        Config.option,
+        Effect.map((value) => Option.getOrElse(value, () => Redacted.make("")))
+      );
+      const githubEncryptionKey = yield* Config.redacted(
+        "INTEGRATION_ENCRYPTION_KEY"
+      ).pipe(
+        Config.option,
+        Effect.flatMap(
+          Option.match({
+            onNone: () => Config.redacted("AUTH_ENCRYPTION_KEY"),
+            onSome: Effect.succeed,
+          })
+        )
+      );
       // Outbound-webhook security configuration (encryption key and egress
       // policy) is owned by WebhookIntegrationConfig in the domain package.
       const integrationConnectionConcurrency = yield* Config.schema(
@@ -68,6 +107,13 @@ export class ServerConfig extends Context.Service<ServerConfig>()(
         appUrl,
         appRootDomain,
         clientIpProxyTrust,
+        githubAppId,
+        githubAppSlug,
+        githubClientId,
+        githubClientSecret,
+        githubEncryptionKey,
+        githubPrivateKey,
+        githubWebhookSecret,
         integrationConnectionConcurrency,
         integrationGlobalConcurrency,
         nodeEnv,

apps/server/src/discord.ts

@@ -8,7 +8,10 @@ import {
 import type { IntegrationProviderRegistry } from "@feeblo/integration-core";
 import { DiscordOAuthState } from "@feeblo/integration-discord";
 import type { ParsedDiscordInboundRequest } from "@feeblo/integration-discord/inbound-schema";
-import { discordProviderKey } from "@feeblo/integration-discord/manifest";
+import {
+  discordInteractionsCapabilityKey,
+  discordProviderKey,
+} from "@feeblo/integration-discord/manifest";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 import * as Layer from "effect/Layer";
@@ -55,7 +58,7 @@ const handleInteraction = (
 ) =>
   Effect.gen(function* () {
     const inboundHandler = registry.getInboundHandler({
-      capabilityKey: "interactions",
+      capabilityKey: discordInteractionsCapabilityKey,
       provider: discordProviderKey,
     });
     if (inboundHandler === undefined) {