PR Summary

Medium Risk
Adds automatic Linear webhook create/delete via the Linear GraphQL API and new v2 trigger IDs, which changes how subscriptions are managed and introduces reliance on external API/key configuration.

Overview
Introduces a new Linear v2 trigger set that uses an API key to automatically create/delete Linear webhooks, eliminating manual webhook URL/secret setup.

Adds LinearV2Block (toolbar-visible) while renaming/hiding the existing LinearBlock as Legacy to keep existing workflows working, and registers the new linear_v2 block and 15 _v2 triggers in the block/trigger registries.

Extends the Linear webhook provider with matchEvent filtering for non-“all events” triggers and createSubscription/deleteSubscription logic that calls Linear’s GraphQL API, persists externalId + generated webhookSecret, and maps trigger IDs to Linear resourceTypes via a new LINEAR_RESOURCE_TYPE_MAP plus shared v2 sub-block builder/instructions.

^{Reviewed by Cursor Bugbot for commit f6ea743. Configure here.}

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 6, 2026 8:35pm

Greptile Summary

This PR adds 15 Linear v2 triggers with automatic webhook lifecycle management — users provide an API key and Sim registers/deregisters webhooks in Linear automatically via the GraphQL API, replacing the manual copy-paste flow of the v1 triggers.

• linearHandler.createSubscription: POSTs a WebhookCreate GraphQL mutation using the user's API key, scopes resource types per LINEAR_RESOURCE_TYPE_MAP, generates a fresh HMAC secret via generateId(), and stores externalId + webhookSecret in providerConfig
• linearHandler.deleteSubscription: Calls WebhookDelete on teardown; failures are non-fatal (warn + return), so trigger deletion is never blocked by transient errors
• buildLinearV2SubBlocks: Shared factory that builds apiKey, teamId, triggerSave, and triggerInstructions sub-blocks, all gated by a selectedTriggerId condition; only linearIssueCreatedV2Trigger includes the dropdown (includeDropdown: true)
• LinearV2Block: Spreads all 15 v2 triggers' sub-blocks into one unified block using the shared dropdown to control visibility via conditions — a clean extension of the existing v1 pattern
• Backwards compatibility: All v1 Linear triggers are preserved with hideFromToolbar: true on LinearBlock; existing workflows continue to work
• Event matching: isLinearEventMatch strips the _v2 suffix before lookup so both v1 and v2 triggers share the same action/type map, and _webhook_v2 correctly bypasses action filtering to pass all events through

Confidence Score: 5/5

Safe to merge — all remaining findings are P2 style/observability suggestions; no correctness, security, or data-integrity issues found

The HTTP-status-check concern from a prior review was already resolved. Core logic (webhook registration, HMAC verification, event routing, delete cleanup, backwards compatibility) is correct and well-guarded. All project rules are followed: user-only visibility for the API key, generateId() for the webhook secret, createLogger for all logging, absolute imports, and no console.log.

No files require special attention. apps/sim/lib/webhooks/providers/linear.ts is the most critical file (external API calls + secret handling) and is correctly implemented.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant User
    participant LinearV2Block
    participant Sim
    participant LinearAPI

    User->>LinearV2Block: Enter API Key + optional Team ID,<br/>select trigger type via dropdown
    User->>LinearV2Block: Click Save Configuration
    LinearV2Block->>Sim: createSubscription()
    Note over Sim: Look up resourceTypes via LINEAR_RESOURCE_TYPE_MAP<br/>Generate webhookSecret = generateId()
    Sim->>LinearAPI: POST /graphql — WebhookCreate mutation<br/>(url, resourceTypes, secret, teamId | allPublicTeams)
    LinearAPI-->>Sim: { success: true, webhook: { id } }
    Note over Sim: Store externalId + webhookSecret in providerConfig

    Note over LinearAPI,Sim: Later: Linear fires an event

    LinearAPI->>Sim: POST /api/webhooks/trigger/{path}<br/>Linear-Signature: hmac-sha256 header
    Note over Sim: verifyAuth — HMAC-SHA256(webhookSecret, rawBody)
    Note over Sim: matchEvent — isLinearEventMatch(triggerId, type, action)<br/>strips _v2 suffix; _webhook_v2 always passes
    alt type + action matches triggerId
        Sim-->>LinearAPI: 200 OK — workflow executes
    else No match
        Note over Sim: Skip — log mismatch, no workflow run
    end

    Note over User,Sim: On trigger delete
    User->>LinearV2Block: Remove trigger
    LinearV2Block->>Sim: deleteSubscription()
    Sim->>LinearAPI: POST /graphql — WebhookDelete(id: externalId)
    LinearAPI-->>Sim: { success: true }
    Note over Sim: Non-fatal — warn + return on any error

_{Reviews (4): Last reviewed commit: "fix build" | Re-trigger Greptile}

Both issues addressed in fd7c856:

1. response.ok checks — added before response.json() in both createSubscription (throws clear HTTP status error) and deleteSubscription (logs warning + returns early).

2. as any → as unknown as Record<string, TriggerOutput> — replaced all 7 casts. The underlying issue is that TriggerOutput's index signature conflicts with nested objects that have a description property (it matches both the index sig's string | undefined and a TriggerOutput child). Direct cast to Record<string, TriggerOutput> fails, so as unknown as is the correct explicit assertion here.

@greptile

@cursor review

@greptile

@cursor review

@greptile

@cursor review