Repository navigation
feat(llc): GitHub PR ↔ work item linking for LLC adapters #9625
Description
Activity
- added a commit that references this issue
on Jun 5, 2026 Security requirement carried over from #9657 (closed — code didn't exist yet)
When this issue introduces a GitHub webhook handler, it must fail closed (the prior fail-open finding had no code to fix because no handler exists yet):
- Return 503 when
GITHUB_WEBHOOK_SECRETis unset — never process unauthenticated webhooks. - Return 401 when the
x-hub-signature-256header is missing. - Verify the HMAC-SHA256 signature before parsing/
json.loadsthe body. - Add tests covering all three failure modes.
- Return 503 when
- added a commit that references this issue
on Jun 13, 2026 ✅ Closed — implementation + integration verified, merged to
Dev_new_gui.Merge commit:
fd774e20(PR #10061, squashed)What shipped
linked_pr_urlsJSONB column onllc_work_items+ migration20260612_056_llc_pr_linking(revises head20260612_055)POST /api/llc/webhooks/github— fail-closed webhook (503 withoutGITHUB_WEBHOOK_SECRET, 401 on bad HMAC-SHA256), resolves the work item from branch (llc/{id},autobot-llc/{id},llc-{id}) or PR body (Closes #llc-{id}), validates the PR URL against the webhook repo, transitions toin_reviewon merge, comments on close-without-mergePOST /api/llc/work-items/{id}/link-pr— IDOR-guarded agent endpoint with the same strict URL validation- 🔗 PR badge on Kanban work-item cards
- Docs:
docs/llc/github-pr-integration.md(branch convention + webhook setup), linked fromdocs/llc/_index.md; liveautobot-llcskill updated with the branch convention + link-pr endpoint
Acceptance criteria
- Agent can link a PR —
POST /api/llc/work-items/{id}/link-pr(andPATCHalready accepted arbitrary fields) - GitHub webhook auto-links PRs whose branch matches
llc/{work_item_id}(andautobot-llc/,llc-, plus PR-bodyCloses #llc-{id}) - Work item status auto-transitions to
in_reviewon PR merge - Frontend shows a PR status badge on the work item card
- Branch naming convention documented in the autobot-llc skill +
docs/llc/
Integration:
llc/api/__init__.py:54mountsgithub_webhooks_router;llc/api/work_items.py:79consumesvalidate_github_pr_url;_item_to_dictexposeslinked_pr_urls.Verification: 36 new tests in
test_github_webhooks.py(all pass); CI green onsmoke-test,code-quality,migration-matrix,llc-e2e,llc-wiring-audit,api-wiring,startup-import-smoke,hardened-smoke-test,duplication-guard.Note: ported and hardened prior unmerged work from local branch
issue-MVA-3716-pr-linking(never PR'd, 1540 commits stale), fixing its gaps — the original commit referenced the model column and router registration but never actually added them.
Problem
When an LLC agent (running via
ClaudeCodeAdapter) opens a GitHub PR, there is no way to:Agents currently commit and push but the connection between code change and work item is lost.
Solution
linked_pr_urls: list[str]field toLLCWorkItemmodel and migrationPOST /api/llc/work-items/{id}/link-prendpoint accepting{pr_url, pr_number, repo}pull_requestevents (opened, closed, merged), match PR body/branch name patterns (autobot-llc/{work_item_id}orCloses #llc-{id}) and auto-linkin_review; when PR is closed without merge → add comment to work itemAnalogy
Paperclip's
inheritExecutionWorkspaceFromIssueId+ checkout worktree system keeps PRs tied to issues throughout the lifecycle.Acceptance Criteria
PATCH /api/llc/work-items/{id}withlinked_pr_urlduring heartbeatllc/{work_item_id}Parent
Closes part of #8207 (Phase 3 — Heartbeat + Adapters) / #8204