Hi, first time writer, long time reader here.
Even though it feels like this should be an already solved problem, I haven’t been able to find anything that really fits my situation.
The background
- I’m trying to sync multiple boards across multiple platforms (Github, Gitlab and Jira).
- I have written a small forge app that uses an issue event listener to send messages to a central webhook which handles the synchronization across platforms, once a user creates or updates issues in Jira.
The problem
This works fine as long as all changes originate from Jira. Once an issue on another platform (e.g. Github) spawns an update event, the API call to my Jira project will update the issue.
This itself triggers an issue event within Jira, which will spawn another message that will be send to my central webhook.
The workaround
To avoid spawning issue events for changes caused by API calls, I have added a webtrigger to my forge app which parses the incoming REST call and executes the issue update within the “asApp” context. This way I can set a filter on my product event trigger to ignore all events that have the self-generated flag set.
This works just fine. However, using webtriggers means that I now have to deal with securing those endpoints myself. As authentication hasn’t been added as a feature to forge webtriggers yet, I see REST API authentication as my only option.
To summarize, I want to:
- Listen for changes on Jira issues.
- Send events once changes occur.
- Be able to accept API calls which update an issue without spawning another issue event.
My question
What would be the recommended way of dealing with this situation? Would you go ahead and secure the webtrigger endpoint or is there a better solution which avoids adding a webtrigger in the first place?