Sentry <> Github Team Sync Webhook Handler

What is this webhook handler for?

The goal is to use this webhook handler to receive requests from Github when there are changes to any GH teams and update the state of teams in Sentry. The handler currently supports the following operations/callbacks:

• New Team created
• Team deleted
• Member added to an existing team
• Member removed from an existing team

NOTE: For the member events to work, the handler fetches the public email address from GH profiles based on the ID, so make sure that members in the organization have a public GH email that matches the email in Sentry

How to use this webhook handler?

This is a flask server that needs to be hosted in a fully qualified domain name (FQDN), which is resolvable on the internet.

In order to run this server succesfully, you will need to add the following environment variables:

GH_TOKEN

The handler uses a GH authentication token which can be obtained from any of the ways listed here (This was tested with a fine-grained personal token) [Settings] -> [Developer Settings] -> Personal Access Tokens -> Fine-grained tokens (No permissions required for fine-grained personal tokens)

SENTRY_TOKEN

The handler uses a Sentry Auth Token to call the Team API endpoints You can create a token by following this guide, with Team Admin and Member Read&Write permissions

SENTRY_ORG_SLUG

Your Sentry org slug. Found under [Settings] -> [Organization Settings] -> [Organization Slug]. Used to build the API url endpoints.

GH_WEBHOOK_TOKEN

Your Secret Token used to validate and authenticate requests coming from GH. Make sure that this value is the same as the one added to the Webhook Settings

How to set up the webhook

1. Go to your GH organization settings
2. Create a new webhook under [Code, planning and automation] -> [Webhooks]
3. Add the payload URL to the domain where this server is hosted
4. Select application/json under Content type
5. Add the secret to the webhook (It has to be the same string as the one in your env variable)
6. Under Which events would you like to trigger this webhook, select:
   • Memberships
   • Teams
7. Save changes

After following the steps, the payload URL should get called once any of the events specified in the webhook is called.