Trigger a fix PR from Sentry

Sentry issue webhook (Sentry-Hook-Signature)
  → your relay: verify the exact raw bytes
  → your config: occurrence class + reviewed firing map
  → signed ingest of the exact bytes
  → Automation predicate ladder and per-Automation dedupe
  → AutomationRun → Session with frozen Agent and Environment

import { Checkfu } from "@checkfu/sdk"

const checkfu = new Checkfu({ apiKey: process.env.CHECKFU_API_KEY! })

const createForClass = (
	name: string,
	predicate: { kind: "equals"; pointer: string; value: string },
) =>
	checkfu.automations.create(
		{
			name,
			created_by: process.env.CHECKFU_PRINCIPAL_ID!,
			identity: { acted_as: process.env.CHECKFU_PRINCIPAL_ID! },
			environment_id: process.env.CHECKFU_ENVIRONMENT_ID!,
			target: {
				kind: "agent_definition",
				agent: { type: "agent", id: process.env.CHECKFU_AGENT_ID! },
			},
			trigger: {
				kind: "webhook",
				dedupe_key: { kind: "json_pointer", pointer: "/data/issue/id" },
				filter: { predicates: [predicate] },
			},
			input: {
				kind: "template",
				prompt_template:
					"A Sentry issue in a mapped project fired. Fetch the issue and its latest event through the governed connection, diagnose, and open a fix PR.",
				resources: [
					{
						kind: "file_tree",
						file_tree_id: process.env.CHECKFU_FILE_TREE_ID!,
						mount_path: "/mnt/repo",
						version_policy: { kind: "latest" },
						access: "read_write",
						// A writable Git mount needs its publication policy:
						// the fix lands as a pull request, never a direct push.
						writeback: {
							kind: "pull_request",
							commit_message: "Fix the Sentry-reported issue",
							pull_request_title: "Fix the Sentry-reported issue",
						},
					},
				],
			},
			ingest_secret: process.env.CHECKFU_AUTOMATION_SECRET!,
		},
		{ idempotencyKey: `sentry-${name}` },
	)

// Fires on the first appearance of an issue group.
await createForClass("sentry-python-new", {
	kind: "equals",
	pointer: "/action",
	value: "created",
})

// Fires when a resolved issue regresses.
await createForClass("sentry-python-regression", {
	kind: "equals",
	pointer: "/data/issue/substatus",
	value: "regressed",
})

import { createHmac, timingSafeEqual } from "node:crypto"

const HEX_64 = /^[0-9a-f]{64}$/u

const hexDigest = (secret: string, bytes: Buffer) =>
	createHmac("sha256", secret).update(bytes).digest("hex")

const safeEqualHex = (provided: string, expected: string) =>
	provided.length === expected.length &&
	timingSafeEqual(Buffer.from(provided, "utf8"), Buffer.from(expected, "utf8"))

export const verifySentrySignature = ({
	rawBody,
	signatureHeader,
	clientSecret,
}: {
	rawBody: Buffer
	signatureHeader: string | null
	clientSecret: string
}): boolean => {
	if (typeof signatureHeader !== "string" || signatureHeader === "") return false
	if (!Buffer.isBuffer(rawBody) || rawBody.length === 0) return false
	const provided = signatureHeader.trim().toLowerCase()
	if (!HEX_64.test(provided)) return false
	if (safeEqualHex(provided, hexDigest(clientSecret, rawBody))) return true
	try {
		const canonical = Buffer.from(JSON.stringify(JSON.parse(rawBody.toString("utf8"))), "utf8")
		return safeEqualHex(provided, hexDigest(clientSecret, canonical))
	} catch {
		return false
	}
}

const mapSentryEventToConfiguration = ({ mapping, event }) => {
	const key = `${event.installationUuid}:${event.issue.projectSlug}`
	const entry = mapping[key]
	if (
		entry !== null &&
		typeof entry === "object" &&
		entry.newAutomation !== "" &&
		entry.regressionAutomation !== "" &&
		Array.isArray(entry.resources) &&
		entry.resources.length > 0
	) {
		return { kind: "mapped", entry }
	}
	return { kind: "unmapped", key }
}

import { relayProviderWebhook } from "@checkfu/integration-host"

const relay = await relayProviderWebhook({
	delivery: { body: rawBody, headers: sentryHeaders },
	automationIngestSecret: process.env.CHECKFU_AUTOMATION_SECRET!,
	verifyProvider: ({ body, headers }) =>
		verifySentrySignature({
			rawBody: body,
			signatureHeader: headers["sentry-hook-signature"] ?? null,
			clientSecret: process.env.SENTRY_WEBHOOK_CLIENT_SECRET!,
		}),
	forwardToAutomation: ({ body, checkfuSignature }) =>
		fetch(`${process.env.CHECKFU_API!}/v1/ingest/automations/${targetAutomationId}`, {
			method: "POST",
			headers: {
				"content-type": "application/json",
				"checkfu-version": "2026-08-31",
				"checkfu-signature": checkfuSignature,
			},
			body,
		}),
})

if (relay.kind !== "forwarded") throw new Error(`delivery refused: ${relay.kind}`)

node --test test/*.test.mjs