Jira

pip install "flyteplugins-jira[app]"

import flyte
from flyte.extras.webhooks import WebhookAppEnvironment, WebhookEvent, run_once
from flyteplugins.jira import JiraProvider, events

# JIRA_WEBHOOK_TOKEN is mounted automatically. It's a shared token, sent with
# every request: anyone who has it can post a delivery. Restrict `scopes` to
# the projects the app should act on.
app_env = WebhookAppEnvironment(
    name="jira-webhooks",
    providers=[JiraProvider()],
    # Jira project keys.
    scopes=["PROJ"],
    image=flyte.Image.from_debian_base().with_pip_packages("flyteplugins-jira[app]"),
    resources=flyte.Resources(cpu=1, memory="512Mi"),
)

flyte create secret jira-webhook-token --value "$(openssl rand -hex 32)"

@app_env.on_event(events.Issue.CREATED)
async def on_issue_created(event: WebhookEvent) -> dict:
    """Launch triage once per new issue.

    `event.resource_id` is the issue key, such as `PROJ-1`.
    """
    import flyte.remote as remote

    task = remote.Task.get(name="jira-ops.triage_issue", auto_version="latest")
    result = await run_once.aio(
        task,
        key=event.dedupe_key(),
        issue_key=event.resource_id,
    )
    return {"run": result.run.name, "created": result.created}

env = flyte.TaskEnvironment(
    name="jira-ops",
    image=flyte.Image.from_debian_base().with_pip_packages("jira"),
    secrets=[
        flyte.Secret(key="jira-url", as_env_var="JIRA_URL"),
        flyte.Secret(key="jira-email", as_env_var="JIRA_EMAIL"),
        flyte.Secret(key="jira-api-token", as_env_var="JIRA_API_TOKEN"),
    ],
    resources=flyte.Resources(cpu=1, memory="512Mi"),
)

@env.task
async def triage_issue(issue_key: str) -> str:
    """Comment on an issue and move it to In Progress.

    Transition IDs differ between workflows, so this looks up the transition
    by name instead of hard-coding an ID.
    """
    import asyncio
    import os

    from jira import JIRA

    def _work() -> str:
        client = JIRA(
            server=os.environ["JIRA_URL"],
            basic_auth=(os.environ["JIRA_EMAIL"], os.environ["JIRA_API_TOKEN"]),
        )
        issue = client.issue(issue_key)
        client.add_comment(issue, "Triaged by Flyte.")
        for transition in client.transitions(issue):
            if transition["name"].lower() == "in progress":
                client.transition_issue(issue, transition["id"])
                return transition["name"]
        return "no matching transition"

    # The `jira` client is synchronous; run it off the event loop.
    return await asyncio.to_thread(_work)

# A separate environment with no secrets, so the replay runs before any
# secret is created.
replay_env = flyte.TaskEnvironment(
    name="jira-replay",
    image=flyte.Image.from_debian_base().with_pip_packages("flyteplugins-jira"),
    resources=flyte.Resources(cpu=1, memory="512Mi"),
)

@replay_env.task
async def replay_sample_delivery() -> dict[str, str]:
    """Verify and parse the sample delivery bundled with the plugin.

    Jira doesn't sign deliveries, so `verify` compares a shared token in the
    `X-Webhook-Token` header. The sample's sign function only sets that header.
    """
    import flyteplugins.jira as plugin

    secret = "a-shared-webhook-token"
    sign, body = plugin.SAMPLE_DELIVERY
    headers = sign(body, secret)

    assert plugin.verify(body, headers, secret), "the right token must verify"
    assert not plugin.verify(body, headers, "wrong-token"), "a wrong token must not"

    event = plugin.parse(headers, body)
    return {
        # For example, `jira:issue_created`. Some Jira event names have the
        # `jira:` prefix and some don't.
        "qualified_type": event.qualified_type,
        "scope": event.scope or "",
        "resource_id": event.resource_id or "",
        "title": event.title or "",
        "dedupe_key": event.dedupe_key(),
        # False for Jira. The setup dashboard shows this too.
        "provider_signs_deliveries": str(plugin.JiraProvider().signed),
    }

flyte run --local jira_tasks.py replay_sample_delivery