[DRAFT] feat: forward webhooks to codecov

migrations_lockfile.txt

@@ -9,7 +9,7 @@ explore: 0004_add_explore_last_visited_table
 
 feedback: 0004_index_together
 
-hybridcloud: 0021_django_arrayfield_scope_list
+hybridcloud: 0022_update_webhook_payload
 
 insights: 0001_add_starred_transactions_model
 

src/sentry/codecov/client.py

@@ -0,0 +1,129 @@
+import datetime
+import logging
+from enum import StrEnum
+from typing import TypeAlias
+
+import requests
+from rest_framework import status
+
+from sentry import options
+from sentry.api.exceptions import SentryAPIException
+from sentry.utils import jwt
+
+GitProviderId: TypeAlias = str
+
+
+class GitProvider(StrEnum):
+    """
+    Enum representing the Git provider that hosts the user/org that a
+    `CodecovApiClient` instance is acting on behalf of.
+
+    Codecov doesn't require this to be GitHub, but that's all that's implemented
+    for now.
+    """
+
+    GitHub = "github"
+
+
+logger = logging.getLogger(__name__)
+
+TIMEOUT_SECONDS = 10
+
+
+class ConfigurationError(SentryAPIException):
+    status_code = status.HTTP_500_INTERNAL_SERVER_ERROR
+    code = "configuration-error"
+
+
+class CodecovApiClient:
+    """
+    Thin client for making JWT-authenticated requests to the Codecov API.
+
+    For each request, Sentry creates and signs (HS256) a JWT with a key shared
+    with Codecov. This JWT contains information that Codecov needs to service
+    the request.
+    """
+
+    def _create_jwt(self):
+        now = int(datetime.datetime.now(datetime.UTC).timestamp())
+        exp = now + 300  # 5 minutes
+        claims = {
+            "iss": "https://sentry.io",
+            "iat": now,
+            "exp": exp,
+        }
+        claims.update(self.custom_claims)
+
+        return jwt.encode(claims, self.signing_secret, algorithm="HS256")
+
+    def __init__(
+        self,
+        git_provider_user: GitProviderId | None,
+        git_provider: GitProvider = GitProvider.GitHub,
+    ):
+        """
+        Creates a `CodecovApiClient`.
+
+        :param git_provider_user: The ID of the current Sentry user's linked git
+           provider account, according to the git provider.
+        :param git_provider: The git provider that the above user's account is
+           hosted on.
+        """
+
+        if not (base_url := options.get("codecov.base-url")):
+            raise ConfigurationError()
+
+        if not (signing_secret := options.get("codecov.api-bridge-signing-secret")):
+            raise ConfigurationError()
+
+        self.base_url = base_url
+        self.signing_secret = signing_secret
+        self.custom_claims = {
+            "g_u": git_provider_user,
+            "g_p": git_provider,
+        }
+
+    def get(self, endpoint: str, params=None, headers=None) -> requests.Response | None:
+        """
+        Makes a GET request to the specified endpoint of the configured Codecov
+        API host with the provided params and headers.
+
+        :param endpoint: The endpoint to request, without the host portion. For
+           examples: `/api/v2/gh/getsentry/users` or `/graphql`
+        :param params: Dictionary of query params.
+        :param headers: Dictionary of request headers.
+        """
+        headers = headers or {}
+        token = self._create_jwt()
+        headers.update(jwt.authorization_header(token))
+
+        url = f"{self.base_url}{endpoint}"
+        try:
+            response = requests.get(url, params=params, headers=headers, timeout=TIMEOUT_SECONDS)
+        except Exception:
+            logger.exception("Error when making GET request")
+            return None
+
+        return response
+
+    def post(self, endpoint: str, data=None, headers=None) -> requests.Response | None:
+        """
+        Makes a POST request to the specified endpoint of the configured Codecov
+        API host with the provided data and headers.
+
+        :param endpoint: The endpoint to request, without the host portion. For
+           examples: `/api/v2/gh/getsentry/users` or `/graphql`
+        :param data: Dictionary of form data.
+        :param headers: Dictionary of request headers.
+        """
+        headers = headers or {}
+        token = self._create_jwt()
+        headers.update(jwt.authorization_header(token))
+        url = f"{self.base_url}{endpoint}"
+        try:
+            response = requests.post(url, data=data, headers=headers, timeout=TIMEOUT_SECONDS)
+        except Exception:
+            logger.exception("Error when making POST request")
+            return None
+
+        return response

src/sentry/conf/server.py

@@ -3383,6 +3383,8 @@ def custom_parameter_sort(parameter: dict) -> tuple[str, int]:
 
 SENTRY_REPLAYS_SERVICE_URL = "http://localhost:8090"
 
+# Codecov is disabled by default
+SENTRY_CODECOV_URL = None
 
 SENTRY_ISSUE_ALERT_HISTORY = "sentry.rules.history.backends.postgres.PostgresRuleHistoryBackend"
 SENTRY_ISSUE_ALERT_HISTORY_OPTIONS: dict[str, Any] = {}

src/sentry/hybridcloud/migrations/0022_update_webhook_payload.py

@@ -0,0 +1,38 @@
+# Generated by Django 5.2.1 on 2025-05-21 20:33
+
+from django.db import migrations, models
+
+from sentry.new_migrations.migrations import CheckedMigration
+
+
+class Migration(CheckedMigration):
+    # This flag is used to mark that a migration shouldn't be automatically run in production.
+    # This should only be used for operations where it's safe to run the migration after your
+    # code has deployed. So this should not be used for most operations that alter the schema
+    # of a table.
+    # Here are some things that make sense to mark as post deployment:
+    # - Large data migrations. Typically we want these to be run manually so that they can be
+    #   monitored and not block the deploy for a long period of time while they run.
+    # - Adding indexes to large tables. Since this can take a long time, we'd generally prefer to
+    #   run this outside deployments so that we don't block them. Note that while adding an index
+    #   is a schema change, it's completely safe to run the operation after the code has deployed.
+    # Once deployed, run these manually via: https://develop.sentry.dev/database-migrations/#migration-deployment
+
+    is_post_deployment = False
+
+    dependencies = [
+        ("hybridcloud", "0021_django_arrayfield_scope_list"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="webhookpayload",
+            name="destination_type",
+            field=models.CharField(db_default="sentry_region"),
+        ),
+        migrations.AlterField(
+            model_name="webhookpayload",
+            name="region_name",
+            field=models.CharField(null=True),
+        ),
+    ]

src/sentry/hybridcloud/models/webhookpayload.py

@@ -4,7 +4,7 @@
 from typing import Any, Self
 
 from django.db import models
-from django.db.models import Case, ExpressionWrapper, F, IntegerField, Value, When
+from django.db.models import Case, ExpressionWrapper, F, IntegerField, TextChoices, Value, When
 from django.http import HttpRequest
 from django.utils import timezone
 
@@ -19,13 +19,25 @@
 BACKOFF_RATE = 1.4
 
 
+class DestinationType(TextChoices):
+    SENTRY_REGION = "sentry_region"
+    CODECOV = "codecov"
+
+
 @control_silo_model
 class WebhookPayload(Model):
     __relocation_scope__ = RelocationScope.Excluded
 
     mailbox_name = models.CharField(null=False, blank=False)
     provider = models.CharField(null=True, blank=True)
-    region_name = models.CharField(null=False)
+
+    # Destination attributes
+    # Table is constantly being deleted from so let's make this non-nullable with a default value, since the table should be small at any given point in time.
+    destination_type = models.CharField(
+        choices=DestinationType.choices, null=False, db_default=DestinationType.SENTRY_REGION
+    )
+    region_name = models.CharField(null=True)
+
     # May need to add organization_id in the future for debugging.
     integration_id = models.BigIntegerField(null=True)
 
@@ -69,6 +81,7 @@ class Meta:
 
     __repr__ = sane_repr(
         "mailbox_name",
+        "destination_type",
         "region_name",
         "schedule_for",
         "attempts",
@@ -93,7 +106,8 @@ def get_attributes_from_request(
     def create_from_request(
         cls,
         *,
-        region: str,
+        destination_type: DestinationType,
+        region: str | None,
         provider: str,
         identifier: int | str,
         request: HttpRequest,
@@ -103,6 +117,7 @@ def create_from_request(
         return cls.objects.create(
             mailbox_name=f"{provider}:{identifier}",
             provider=provider,
+            destination_type=destination_type,
             region_name=region,
             integration_id=integration_id,
             **cls.get_attributes_from_request(request),

src/sentry/hybridcloud/tasks/deliver_webhooks.py

@@ -11,8 +11,14 @@
 from rest_framework import status
 
 from sentry import options
+from sentry.codecov.client import CodecovApiClient, ConfigurationError
 from sentry.exceptions import RestrictedIPAddress
-from sentry.hybridcloud.models.webhookpayload import BACKOFF_INTERVAL, MAX_ATTEMPTS, WebhookPayload
+from sentry.hybridcloud.models.webhookpayload import (
+    BACKOFF_INTERVAL,
+    MAX_ATTEMPTS,
+    DestinationType,
+    WebhookPayload,
+)
 from sentry.shared_integrations.exceptions import (
     ApiConflictError,
     ApiConnectionResetError,
@@ -25,7 +31,7 @@
 from sentry.tasks.base import instrumented_task
 from sentry.taskworker.config import TaskworkerConfig
 from sentry.taskworker.namespaces import hybridcloud_control_tasks
-from sentry.types.region import get_region_by_name
+from sentry.types.region import Region, get_region_by_name
 from sentry.utils import metrics
 
 logger = logging.getLogger(__name__)
@@ -403,12 +409,24 @@ def deliver_message(payload: WebhookPayload) -> None:
 
 
 def perform_request(payload: WebhookPayload) -> None:
+    destination_type = payload.destination_type
+
+    match destination_type:
+        case DestinationType.SENTRY_REGION:
+            region = get_region_by_name(name=payload.region_name)
+            perform_region_request(region, payload)
+        case DestinationType.CODECOV:
+            perform_codecov_request(payload)
+        case _:
+            raise ValueError(f"Unknown destination type: {destination_type!r}")
+
+
+def perform_region_request(region: Region, payload: WebhookPayload) -> None:
     logging_context: dict[str, str | int] = {
         "payload_id": payload.id,
         "mailbox_name": payload.mailbox_name,
         "attempt": payload.attempts,
     }
-    region = get_region_by_name(name=payload.region_name)
 
     try:
         client = RegionSiloClient(region=region)
@@ -521,3 +539,72 @@ def perform_request(payload: WebhookPayload) -> None:
             extra={"error": str(err), "response_code": response_code, **logging_context},
         )
         raise DeliveryFailed() from err
+
+
+def perform_codecov_request(payload: WebhookPayload) -> None:
+    """
+    We're dont retrying Codecov forwarding requests for now. We want to prove out that it would work.
+    """
+    logging_context: dict[str, str | int] = {
+        "payload_id": payload.id,
+        "mailbox_name": payload.mailbox_name,
+        "attempt": payload.attempts,
+        "request_method": payload.request_method,
+        "request_path": payload.request_path,
+    }
+
+    with metrics.timer(
+        "hybridcloud.deliver_webhooks.send_request_to_codecov",
+    ):
+        # transform request to match what codecov is expecting
+        if payload.request_path.strip("/") != "extensions/github/webhook":
+            metrics.incr(
+                "hybridcloud.deliver_webhooks.send_request_to_codecov.unexpected_path",
+            )
+            return
+
+        try:
+            endpoint = "/webhooks/sentry"
+            headers = orjson.loads(payload.request_headers)
+            data = {
+                "event": headers.get("HTTP_X_GITHUB_EVENT", "unknown"),
+                "payload": orjson.loads(payload.request_body),
+            }
+            client = CodecovApiClient(None)
+            response = client.post(
+                endpoint=endpoint,
+                data=data,
+                headers=headers,
+            )
+
+            if response is None:
+                metrics.incr(
+                    "hybridcloud.deliver_webhooks.send_request_to_codecov.failure",
+                )
+                return
+
+            logger.debug(
+                "deliver_webhooks.send_request_to_codecov.success",
+                extra={
+                    "status": response.status_code,
+                    **logging_context,
+                },
+            )
+        except ConfigurationError as err:
+            metrics.incr(
+                "hybridcloud.deliver_webhooks.send_request_to_codecov.codecov_configuration_error",
+            )
+            logger.warning(
+                "deliver_webhooks.send_request_to_codecov.codecov_configuration_error",
+                extra={"error": str(err), **logging_context},
+            )
+            return
+        except orjson.JSONDecodeError as err:
+            metrics.incr(
+                "hybridcloud.deliver_webhooks.send_request_to_codecov.json_decode_error",
+            )
+            logger.warning(
+                "deliver_webhooks.send_request_to_codecov.json_decode_error",
+                extra={"error": str(err), **logging_context},
+            )
+            return