dheerajturaga opened a new pull request, #75154: URL: https://github.com/apache/airflow/pull/75154
### Stack Stacks on #75153. Stack index: 6 of 20. Its base is the branch of #75153, so the diff shows only this layer's commit, "AIP-125: Add [webhooks] config, name registry and connection cache". ### Status Draft. [AIP-125 (Inbound Webhooks)](https://lists.apache.org/thread/p3dpnor4zwko8tldpncj6ftj1bpp18q7) is under discussion on dev@ and not yet voted; this stack is its proof of concept so that voters can run it, and nothing should merge before the vote. The feature is opt-in (only `airflow api-server --apps webhooks` serves deliveries) and experimental; no unauthenticated route is reachable until stack PR 18, which merges last. ### Why Webhook deliveries arrive without Airflow credentials, so an anonymous client must not make each request cost a secrets backend call: only listed names are looked up, and a listed name's lookup, failures included, is reused for a while. A failing backend must still read as an outage rather than an unknown webhook, and installing a provider must not decide which package verifies a source type's deliveries. ### What to look at - New experimental options: `names`, `source_type_owners`, `connection_cache_ttl` (60 s), `max_body_bytes` (1 MiB) and `delivery_retention` (7 days, at most 365 to fit a MySQL `TIMESTAMP`). `names` refuses `*` and team-qualified names. No `[inbound_webhooks]` alias. - Resolution walks `ensure_secrets_loaded()` itself: `Connection.get_connection_from_secrets` reports a failing backend as a missing connection, which would be answered 404 and cached. Backend failures are never cached. - A delivery that fails verification may reread the connection once per TTL, so a rotated secret applies to the first delivery signed with it. - The connection's `max_body_bytes` can raise the limit too: whoever may edit `webhook_<name>` administers that webhook. ### Testing - `test_connections.py`, `test_registry.py` and `test_provider_command.py` passed under breeze on SQLite, Postgres and MySQL. After the last fixes, the tests were rerun on SQLite and Postgres, and the final head passed again on MySQL. The default-configuration check passed. ### Known limitations - Team-qualified webhook names are left for 3.6. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) --- * Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged. * For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed. * When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x). * For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
