Skip to content

feat(webhook): forward CP API key, add label trigger, optional review caps - #63

Open
jainakshay93 wants to merge 1 commit into
Agent-Field:mainfrom
jainakshay93:feat/webhook-auth-label-and-limits
Open

feat(webhook): forward CP API key, add label trigger, optional review caps#63
jainakshay93 wants to merge 1 commit into
Agent-Field:mainfrom
jainakshay93:feat/webhook-auth-label-and-limits

Conversation

@jainakshay93

Copy link
Copy Markdown
Contributor

What & why

Three improvements to the GitHub webhook handler (app.py), found running pr-af self-hosted with control-plane auth on a small shared host. All are opt-in / non-breaking.

1. Forward the control-plane API key (bug fix)

_fire_review POSTs to /api/v1/execute/async/pr-af.review with no auth header. When the control plane runs with auth enabled (AGENTFIELD_API_KEY set), that call 401s — so the webhook silently never dispatches a review. Now it forwards AGENTFIELD_API_KEY as X-API-Key when set.

2. Label trigger (feature)

Adds a pull_request labeled handler: applying a configurable label (PR_AF_LABEL, default pr-af) to a PR fires a review — an alternative to the @pr-af comment mention. Handy where teams prefer a label, or where GitHub Actions can't run.

3. Optional review caps for webhook runs (feature)

Webhook-triggered reviews can now read optional per-deployment limits, applied only when set (default behaviour unchanged):

  • PR_AF_MAX_CONCURRENT_REVIEWERS
  • PR_AF_MAX_REVIEW_DEPTH
  • PR_AF_MAX_COVERAGE_ITERATIONS
  • PR_AF_IGNORE_PATHS (comma-separated)

This lets a small/shared host bound resource use (e.g. max_concurrent_reviewers=1, max_review_depth=0) without patching code — the default fan-out (concurrency 8, deep sub-reviews) can exhaust memory on a modest box and deadlock on very large PRs.

Notes

🤖 Generated with Claude Code

… caps

Three improvements to the GitHub webhook handler, found running pr-af
self-hosted with control-plane auth on a small shared host:

1. Forward AGENTFIELD_API_KEY as X-API-Key on the review-dispatch call.
   Without it, the webhook silently 401s whenever the control plane has
   auth enabled, so no webhook-triggered review ever runs.

2. Trigger a review when a configurable label (PR_AF_LABEL, default
   'pr-af') is added to a PR — an alternative to the @mention comment.

3. Optional per-deployment review caps for webhook runs, applied only
   when set (PR_AF_MAX_CONCURRENT_REVIEWERS / PR_AF_MAX_REVIEW_DEPTH /
   PR_AF_MAX_COVERAGE_ITERATIONS / PR_AF_IGNORE_PATHS). Lets a small or
   shared host bound resource use without a code change; default
   behaviour is unchanged when unset.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@CLAassistant

CLAassistant commented Aug 3, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants