key-store/dispatch
1
0
Fork 0
Code Pull requests 4 Releases Activity Actions

GoAlert dispatch ingress: signed webhook to incident steers #20

Open
devex wants to merge 1 commit from devex/goalert-dispatch-ingress into main AGit
pull from: devex/goalert-dispatch-ingress
merge into: key-store:main
Conversation 0 Commits 1 Files changed 5 +795
devex commented 2026-09-14 00:20:00 +00:00
Member
Copy link

Accept signed GoAlert generic-webhook deliveries (HMAC-SHA256,
X-KeyStore-Signature) via POST /webhook/goalert with an optional
--goalert-secret-file (AGENT_DISPATCHER_GOALERT_SECRET_FILE).
Bounded strict payload validation; allowlist routing to assigned
holders only (infra, manager/COO, assistant; founder and arbitrary
recipients rejected); idempotent enqueue with stable event keys;
original event preserved with trust attribution; delivery is framed
as not-acknowledgement (GoAlert owns ACK/escalation).

Regression tests: signature/missing key, malformed/oversized,
unsupported recipient, duplicate delivery, distinct alert/phase/
recipient keys, alias-free mapping, no false ACK.

Redmine: #44 (contract note to follow on #35).

Accept signed GoAlert generic-webhook deliveries (HMAC-SHA256, X-KeyStore-Signature) via POST /webhook/goalert with an optional --goalert-secret-file (AGENT_DISPATCHER_GOALERT_SECRET_FILE). Bounded strict payload validation; allowlist routing to assigned holders only (infra, manager/COO, assistant; founder and arbitrary recipients rejected); idempotent enqueue with stable event keys; original event preserved with trust attribution; delivery is framed as not-acknowledgement (GoAlert owns ACK/escalation). Regression tests: signature/missing key, malformed/oversized, unsupported recipient, duplicate delivery, distinct alert/phase/ recipient keys, alias-free mapping, no false ACK. Redmine: #44 (contract note to follow on #35). 
Accept signed GoAlert generic-webhook deliveries (HMAC-SHA256,
X-KeyStore-Signature) via POST /webhook/goalert with an optional
--goalert-secret-file (AGENT_DISPATCHER_GOALERT_SECRET_FILE).
Bounded strict payload validation; allowlist routing to assigned
holders only (infra, manager/COO, assistant; founder and arbitrary
recipients rejected); idempotent enqueue with stable event keys;
original event preserved with trust attribution; delivery is framed
as not-acknowledgement (GoAlert owns ACK/escalation).

Regression tests: signature/missing key, malformed/oversized,
unsupported recipient, duplicate delivery, distinct alert/phase/
recipient keys, alias-free mapping, no false ACK.

Redmine: #44 (contract note to follow on #35).
This pull request has changes conflicting with the target branch.
  • internal/agentdispatcher/api.go
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin +refs/pull/20/head:devex/goalert-dispatch-ingress
git switch devex/goalert-dispatch-ingress
Sign in to join this conversation.
Reviewers
No reviewers
security-agent
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
key-store/dispatch!20
No description provided.