dheerajturaga opened a new pull request, #75050: URL: https://github.com/apache/airflow/pull/75050
### Stack Stacks on #75049. Stack index: 18 of 20. A PR from a fork cannot target a fork branch, so each PR in the stack is based on `main` and contains every commit below it; only the top commit is new. Review only the commit "AIP-125: Serve inbound webhooks with api-server --apps webhooks"; the commits below it belong to earlier PRs in the stack. ### Status Draft. [AIP-125 (Inbound Webhooks)](https://lists.apache.org/thread/p3dpnor4zwko8tldpncj6ftj1bpp18q7) is under discussion on dev@ and not yet voted; this stack is its proof of concept so that voters can run it, and nothing should merge before the vote. This is the exposure PR, the only one that makes an unauthenticated route reachable: it merges last, after stack PRs 14 and 15 are approved, so that Phases 1a and 1b ship together or not at all. The feature stays opt-in and experimental. ### Why Senders reach webhooks from networks that the UI and REST API should not face, so only a process started with `--apps webhooks` serves them; `all` stays `core,execution`, and the core process answers `/webhooks/*` with a JSON 404. A webhooks-only process serves no API docs, needs no signing keys, refuses to start when no webhooks are listed, and logs each source type it cannot serve. ### What to look at - `/webhooks` joins `RESERVED_URL_PREFIXES`, which touches every deployment: a plugin app whose `url_prefix` starts with `/webhooks`, even `/webhooks-legacy`, is skipped. - `app.state.secret_key` moves into the core branch of `create_app`, and the CLI computes signing args only when core or execution is served. - Tests pin the surface: a webhooks-only server serves nothing at its root but the mount, so a new route fails CI. - `security_model.rst` keeps `/webhooks/*` under the security process while experimental, and lists the residual risks; `web-stack.rst` covers the proxy. - The FAB mount test keeps its own module, so that its guard for older cores skips no other test. ### Testing - `test_app.py`, `test_api_server_command.py`, the access-log and metrics tests and the FAB mount test passed under breeze on SQLite, Postgres and MySQL. After the last fixes, `test_app.py` and the FAB mount test were rerun on SQLite and Postgres, and the final head passed again on MySQL. - The live demo (`demo.sh 1a 1b`) passed on Postgres and MySQL, and again on Postgres after the last fixes. ### Known limitations - A security-team review of AIP section 5 and this carve-out is still to be requested. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) --- * Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged. * For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed. * When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x). * For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
