getmomentum / momentum-core

open-source code auditor for backend
https://www.momentum.sh/
Apache License 2.0
70 stars 7 forks source link

Github app to provide blast radius or test plan #28

Open dhirenmathur opened 3 days ago

dhirenmathur commented 3 days ago

Description

Develop a new GitHub app that listens to webhooks on PR creation, PR updates, and PR comments that mention the bot with a command. The bot should integrate with the Momentum app, and users who install the bot need to be signed up for the Momentum app.

Workflow

User signs up to momentum and installs app on their repo. There should be a user preference page on UI that has a toggle to turn on or turn off PR integration on Github. (not part of this task) Receive webhook: Handle webhooks differently for PR update, PR create, comment with mention, and comment without mention. PR update: Parse the webhook body for the branch name, repo name, and base branch name. Retrieve the project ID using the repo name, branch name, ( in case of multiple, choose the oldest one) Fetch the blast radius for the project using project id and base branch name. Comment on the PR with the blast radius information in a table format. PR create: Parse the webhook body for the branch name, repo name, and base branch name. Since we need the user id against which we need to create the project, retrieve the user id from project table by querying using repo name, in the case that multiple users have linked the same repo on momentum, choose the oldest user Create a project for the branch and repo Fetch the blast radius for the project and base branch name. Comment on the PR with the blast radius information in a table format. Comment with mention: Listen for a /plan {identifier} command in the comment that mentions the bot. Parse the webhook body for the repo name and branch name. Retrieve the project ID using the repo name and branch name. Fetch the test plan for the specified identifier. Comment on the PR with the test plan information and the project ID. Comment without mention: Ignore the comment.

Relevant documentation:

parthfloyd commented 3 days ago

Thanks @dhirenmathur for a detailed description! I'd like to work on this!

dhirenmathur commented 3 days ago

@parthfloyd awesome, I've assigned you the issue, let me know if you need any more context!

parthfloyd commented 16 hours ago

@dhirenmathur I'm looking forward to incorporate the following changes:

Please feel free to add any feedback on this.

dhirenmathur commented 16 hours ago

Sounds good overall, can you provide more detail around the flow of the request handler. @parthfloyd

parthfloyd commented 15 hours ago

Yes @dhirenmathur Firstly I'll fetch the event type (installation_repositories, issue_comment, pull_request) using the header: X-Github-Event & then checking its action& calling the required function (ideally as a coroutine object)

For example: for a new PR, event: pull_request, action: opened. fetching blast radius for the branch & commenting on the PR in a table format.