Skip to content

fix(webhooks): make health route service-binding-only #104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iamjr15 merged 1 commit into from
Jul 31, 2026
Merged

fix(webhooks): make health route service-binding-only #104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion apps/webhooks-worker/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,9 @@ The handler therefore resolves that Composio-project-global ID through the datab
primary key; ownership and toolkit assignment are immutable after insertion,
and terminal status changes atomically reconcile the user's active default.

Production binds one immutable `CHEATCODE_RELEASE_SHA`, exposed by `/health`.
Production binds one immutable `CHEATCODE_RELEASE_SHA`, exposed by `/health`
only to the gateway's service-binding probe (`https://webhooks.internal/health`);
on the public webhook host the route answers as not found.
HTTP, cron, idempotency, deletion, and workflow continuation paths use their
normal durable ownership and idempotency contracts; database migrations retain
their separate target, role, lock, and schema validation.
Expand Down
14 changes: 10 additions & 4 deletions apps/webhooks-worker/src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,14 +165,20 @@ webhooksApp.use(
}),
);

webhooksApp.get("/health", (c) =>
c.json({
webhooksApp.get("/health", (c) => {
// Service-binding-only surface: the gateway probes https://webhooks.internal/health
// for release aggregation. The public webhook host must answer like the route does
// not exist so release metadata never leaks on an unauthenticated endpoint.
if (new URL(c.req.url).hostname !== "webhooks.internal") {
return c.notFound();
}
return c.json({
ok: true,
releaseSha: c.env.CHEATCODE_RELEASE_SHA ?? "development",
versionId: c.env.CF_VERSION_METADATA?.id ?? null,
worker: "webhooks",
}),
);
});
});

webhooksApp.post("/clerk", async (c) => {
const signingSecret = await clerkWebhookSigningSecret(c.env);
Expand Down