fix(github-webhook): check membership across multiple teams

[aidankmcalister]

Summary by CodeRabbit

• Chores
  • Updated webhook authorization to validate memberships across multiple teams simultaneously, improving flexibility in team-based access control for pull request workflows

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
blog	Ready	Preview, Comment	Mar 26, 2026 1:33pm
docs	Ready	Preview, Comment	Mar 26, 2026 1:33pm
eclipse	Ready	Preview, Comment	Mar 26, 2026 1:33pm
site	Ready	Preview, Comment	Mar 26, 2026 1:33pm

[coderabbitai]

Walkthrough

The webhook's team membership verification now checks multiple GitHub organization teams concurrently. It transitions from a single hardcoded team lookup to parallel requests against both dev-connections-write and webdev-write teams, consolidating authorization headers into a reusable constant.

Changes

Cohort / File(s)	Summary
Webhook Team Membership Check apps/docs/src/app/api/github-webhook/route.ts	Refactored team membership validation to query multiple teams in parallel using Promise.all instead of a single sequential request. Authorization headers now extracted to a shared constant. Membership condition logic changed from single status check to aggregate predicate using some() to verify if any team contains the PR author. Both team slugs and user login encoded with encodeURIComponent.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: updating the GitHub webhook to check membership across multiple teams instead of a single hard-coded team.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[argos-ci]

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
default (Inspect)	✅ No changes detected	-	Mar 26, 2026, 1:40 PM

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/docs/src/app/api/github-webhook/route.ts`:
- Around line 41-49: The GitHub membership fetches using teamSlugs ->
Promise.all are missing timeouts and error handling; update the logic around
membershipResults / isTeamMember to use per-request AbortController (or a shared
timeout) and wrap the parallel calls so failures don’t reject the whole
Promise.all: either use Promise.allSettled or catch individual fetch errors,
treat non-200 or errored responses as non-members, and ensure you pass
authHeaders into each fetch and clear/handle the abort signal; update the code
paths that compute membershipResults and isTeamMember to reflect these guarded
outcomes so network timeouts or fetch errors return false rather than throwing.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 55398a16-9abf-4ea7-9441-bea25be838c7

📥 Commits

Reviewing files that changed from the base of the PR and between edda9c3 and 8e53363.

📒 Files selected for processing (1)

• apps/docs/src/app/api/github-webhook/route.ts