Summary

Request the events/permissions of GitHub webhook handlers on app creation.

Review Request #15337 — Created Sept. 24, 2026 and updated Oct. 9, 2026, 3:39 p.m.

Information

Owner

maubin

Repository

Review Board

Branch

release-9.x

Bugs

Depends On

15335

Blocks

15338

Reviewers

Groups

reviewboard

People

Description

When creating a GitHub App, we send a manifest listing the events and

permission the app requires, and we display these to the admin creating

the app. This change includes the events and permissions of any

registered webhook handlers into the manifest and admin display.
We now have public constants for the built in events and permissions

required by core Review Board, making it easy to see and reference these

in docs. This also removes the pull_requests permission from the

defaults since it will be pulled in by Power Pack's pull request

integration handler.
In the future we should probably leverage the "needs attention" GitHub

App state in our admin UI to lets admins know to update their app

settings on GitHub whenever new webhook handlers are registered that

require events/permissions that haven't been granted yet.

Testing Done


Ran unit tests.
Created a GitHub app while having a handler that requires certain

  events and permissions.

Commits

Summary	ID
Request the events/permissions of GitHub webhook handlers on app creation. When creating a GitHub App, we send a manifest listing the events and permission the app requires, and we display these to the admin creating the app. This change includes the events and permissions of any registered webhook handlers into the manifest and admin display. This also removes the `pull_requests` permission from the defaults since it will be pulled in by Power Pack's pull request integration handler. In the future we may want to think of some UI that lets admins know to update their app settings on GitHub whenever new webhook handlers are registered that require events/permissions that haven't been granted yet.	4cd1c643631f8a8a036d5f7987c88fce8cc8ecdf

Summary

Request the events/permissions of GitHub webhook handlers on app creation.

When creating a GitHub App, we send a manifest listing the events and permission the app requires, and we display these to the admin creating the app. This change includes the events and permissions of any registered webhook handlers into the manifest and admin display. This also removes the `pull_requests` permission from the defaults since it will be pulled in by Power Pack's pull request integration handler. In the future we may want to think of some UI that lets admins know to update their app settings on GitHub whenever new webhook handlers are registered that require events/permissions that haven't been granted yet.

4cd1c643631f8a8a036d5f7987c88fce8cc8ecdf

Issues

Description	From	Last Updated
We should make sure this is sorted. The results from get_events() are not in a stable order (because it's a …	david	Oct. 1, 2026, 1:11 p.m.
Maybe worth defining this as a set? That further simplifies default_events	david	Oct. 1, 2026, 1:12 p.m.
This test exercises the case of a new permission, and de-duplication of an existing one, but not a handler that …	david	Oct. 1, 2026, 1:14 p.m.
Might be good to also use frozenset for all these.	david	Oct. 8, 2026, 4:43 p.m.
Oh, I commented about this in /r/15335. Let's move this into that change.	david	Oct. 8, 2026, 4:40 p.m.

flake8 passed.

JSHint passed.

reviewboard/hostingsvcs/github/views.py (Diff revision 1)

The issue has been resolved. Show all issues

We should make sure this is sorted. The results from get_events() are not in a stable order (because it's a set), and so this can switch around things in the app manifest, the UI, and tests.
That can simplify things too:

default_events = sorted(
    (set(DEFAULT_GITHUB_APP_EVENTS) | handler_registry.get_events()) -
    GITHUB_APP_AUTO_DELIVERED_EVENTS)

reviewboard/hostingsvcs/github/webhooks.py (Diff revision 1)
The issue has been resolved. Show all issues
```
Maybe worth defining this as a set? That further simplifies default_events
```

reviewboard/hostingsvcs/tests/github/test_app_views.py (Diff revision 1)

The issue has been resolved. Show all issues

This test exercises the case of a new permission, and de-duplication of an existing one, but not a handler that raises the permission level of a built-in handler. Can we have it require 'contents': 'write' so we cover that part?

Commits:

	Summary	ID
	Request the events/permissions of GitHub webhook handlers on app creation. When creating a GitHub App, we send a manifest listing the events and permission the app requires, and we display these to the admin creating the app. This change includes the events and permissions of any registered webhook handlers into the manifest and admin display. This also removes the `pull_requests` permission from the defaults since it will be pulled in by Power Pack's pull request integration handler. In the future we may want to think of some UI that lets admins know to update their app settings on GitHub whenever new webhook handlers are registered that require events/permissions that haven't been granted yet.	0e9a3f815b7aa8b9cf91b3d14cfc99bfa5f10649
	Request the events/permissions of GitHub webhook handlers on app creation. When creating a GitHub App, we send a manifest listing the events and permission the app requires, and we display these to the admin creating the app. This change includes the events and permissions of any registered webhook handlers into the manifest and admin display. This also removes the `pull_requests` permission from the defaults since it will be pulled in by Power Pack's pull request integration handler. In the future we may want to think of some UI that lets admins know to update their app settings on GitHub whenever new webhook handlers are registered that require events/permissions that haven't been granted yet.	4e963c7f5735cc239d9b773ab26a35a8cf229ee8

Depends On:

15335 - Dispatch GitHub App webhook events to handlers.

Diff:

Revision 2 (+394 -60)

Show changes

	reviewboard/hostingsvcs/github/client.py
	reviewboard/hostingsvcs/github/views.py
	reviewboard/hostingsvcs/github/webhooks.py
	reviewboard/hostingsvcs/tests/github/test_app_views.py
	reviewboard/hostingsvcs/tests/github/test_app_webhook_view.py

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

reviewboard/hostingsvcs/github/webhooks.py (Diff revision 2)
The issue has been resolved. Show all issues
```
Might be good to also use frozenset for all these.
```
reviewboard/hostingsvcs/tests/github/test_app_webhook_view.py (Diff revision 2)
The issue has been resolved. Show all issues
```
Oh, I commented about this in /r/15335. Let's move this into that change.
```

Commits:

	Summary	ID
	Request the events/permissions of GitHub webhook handlers on app creation. When creating a GitHub App, we send a manifest listing the events and permission the app requires, and we display these to the admin creating the app. This change includes the events and permissions of any registered webhook handlers into the manifest and admin display. This also removes the `pull_requests` permission from the defaults since it will be pulled in by Power Pack's pull request integration handler. In the future we may want to think of some UI that lets admins know to update their app settings on GitHub whenever new webhook handlers are registered that require events/permissions that haven't been granted yet.	4e963c7f5735cc239d9b773ab26a35a8cf229ee8
	Request the events/permissions of GitHub webhook handlers on app creation. When creating a GitHub App, we send a manifest listing the events and permission the app requires, and we display these to the admin creating the app. This change includes the events and permissions of any registered webhook handlers into the manifest and admin display. This also removes the `pull_requests` permission from the defaults since it will be pulled in by Power Pack's pull request integration handler. In the future we may want to think of some UI that lets admins know to update their app settings on GitHub whenever new webhook handlers are registered that require events/permissions that haven't been granted yet.	4cd1c643631f8a8a036d5f7987c88fce8cc8ecdf

Diff:

Revision 3 (+392 -60)

Show changes

	reviewboard/hostingsvcs/github/client.py
	reviewboard/hostingsvcs/github/views.py
	reviewboard/hostingsvcs/github/webhooks.py
	reviewboard/hostingsvcs/tests/github/test_app_views.py

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

Ship it!

```
Ship It!
```