eas/webhooks

19 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Webhook creation command

Run `eas webhook:create` in each project directory to configure a webhook. You will be prompted to choose the webhook event type (BUILD or SUBMIT), provide a webhook URL that handles HTTP POST requests, and input a webhook signing secret.

Webhook secret requirements

The webhook signing secret must be at least 16 characters long. It is used to calculate the HMAC-SHA1 signature of the request body, which is sent as the value of the `expo-signature` HTTP header.

Webhook event type parameter

Use the `--event BUILD|SUBMIT` parameter with `eas webhook:create` to skip the interactive prompt for choosing event type.

Webhook URL flag

Use the `--url` flag with `eas webhook:create` to specify the webhook URL without being prompted.

Webhook secret flag

Use the `--secret` flag with `eas webhook:create` to specify the webhook signing secret without being prompted.

Webhook HTTP request method and format

EAS calls your webhook using an HTTP POST request. All data is passed in the request body as a JSON object.

Webhook delivery retry behavior

If the webhook responds with an HTTP status code outside of the 200-399 range, delivery will be attempted a few more times with exponential back-off.

List webhooks command

Run `eas webhook:list` to find the webhook ID.

Submit webhook payload structure

Submit webhook payload contains: id (UUID), accountName, projectName, submissionDetailsPageUrl, parentSubmissionId (for retries), appId, archiveUrl, initiatingUserId, cancelingUserId (for canceled submissions), turtleBuildId (available when submitting from EAS), platform (android or ios), status (errored, finished, or canceled), submissionInfo (with error object containing message and errorCode, and logsUrl for failed submissions), createdAt, updatedAt, completedAt, and maxRetryTimeMinutes.

Create webhook for build and submit events

Run `eas webhook:create` to configure webhooks per project. You will be prompted to choose the webhook event type (BUILD or SUBMIT via `--event` parameter), provide the webhook URL (via `--url` flag), and input a webhook signing secret (via `--secret` flag). The secret must be at least 16 characters long.

Testing webhooks locally with ngrok

To test webhooks locally, use a service like ngrok to forward localhost:8080 via a tunnel and make it publicly accessible with the URL that ngrok provides.

Webhook server implementation example with signature verification

Here is an example Node.js/Express webhook server that verifies signatures: ```js const crypto = require('crypto'); const express = require('express'); const bodyParser = require('body-parser'); const safeCompare = require('safe-compare'); const app = express(); app.use(bodyParser.text({ type: '*/*' })); app.post('/webhook', (req, res) => { const expoSignature = req.headers['expo-signature']; // process.env.SECRET_WEBHOOK_KEY has to match SECRET value set with `eas webhook:create` command const hmac = crypto.createHmac('sha1', process.env.SECRET_WEBHOOK_KEY); hmac.update(req.body); const hash = `sha1=${hmac.digest('hex')}`; if (!safeCompare(expoSignature, hash)) { res.status(500).send("Signatures didn't match!"); } else { // Do something here. For example, send a notification to Slack! // console.log(req.body); res.send('OK!'); } }); app.listen(8080, () => console.log('Listening on port 8080')); ```

Webhook configuration per project

Webhooks are configured per project. To set up alerts for multiple projects like @johndoe/awesomeApp and @johndoe/coolApp, run `eas webhook:create` in each project directory.

EAS webhook delivery mechanism

EAS calls webhooks using HTTP POST requests with data passed as a JSON object in the request body. If the webhook responds with an HTTP status code outside the 200-399 range, delivery will be attempted multiple times with exponential back-off.

Webhook signature verification with expo-signature header

EAS sends an `expo-signature` HTTP header containing the hex-encoded HMAC-SHA1 digest of the request body, using the webhook secret as the HMAC key. This signature can be used to verify the authenticity and integrity of the webhook request.

Update webhook URL or secret

Run `eas webhook:update --id WEBHOOK_ID` to change the webhook URL and/or webhook secret. Find the webhook ID using `eas webhook:list`.

Delete webhook

Run `eas webhook:delete` to stop sending requests to a webhook. You will be prompted to choose the webhook from a list.

List all webhooks

Run `eas webhook:list` to find and display all configured webhooks with their IDs.

Build webhook payload structure

Build webhook payload contains: id (UUID), accountName, projectName, buildDetailsPageUrl, parentBuildId (for retries), appId, initiatingUserId, cancelingUserId (for canceled builds), platform (android or ios), status (errored, finished, or canceled), artifacts (buildUrl for successful builds, logsS3KeyPrefix), metadata (appName, username, workflow, appVersion, appBuildVersion, cliVersion, sdkVersion, buildProfile, distribution, appIdentifier, gitCommitHash, gitCommitMessage, runtimeVersion, channel for EAS Update, releaseChannel for legacy updates, reactNativeVersion, trackingContext, credentialsSource, isGitWorkingTreeDirty, message, runFromCI), metrics (memory, buildEndTimestamp, totalDiskReadBytes, buildStartTimestamp, totalDiskWriteBytes, cpuActiveMilliseconds, buildEnqueuedTimestamp, totalNetworkEgressBytes, totalNetworkIngressBytes), error (for failed builds with message and errorCode), createdAt, enqueuedAt, provisioningStartedAt, workerStartedAt, completedAt, updatedAt, expirationDate, priority (high, normal, or low), resourceClass, actualResourceClass, and maxRetryTimeMinutes.

Give your agent this brain