feat(integrations): GitHub ticket sync, ticket email notifications & platform updates

[melihsunbul]

What

Bi-directional GitHub ticket sync, durable ticket email notifications, ticket attachments, and the supporting updates across the integration platform.

Concepts

• External link — a stored mapping between a Quackback ticket (or thread message) and an external object (a GitHub issue or comment), so the two stay associated over time.
• Sync log — per-attempt metadata for outbound/inbound sync, used for diagnostics and loop-prevention.
• Loop prevention — each synced change records its originating integration (syncSourceIntegrationId); events that came from an integration are not sent back to it, and Quackback system markers stop inbound echoes creating duplicate tickets.
• Durable email notification — ticket emails are raised as event targets with a fallback delivery path, so a failure in event processing does not silently drop the notification.

How it works

• GitHub sync (integrations/github/) — hook.ts maps ticket create/update/comment/attachment events to GitHub issues/comments; ticket-inbound.ts ingests GitHub opened/closed/reopened/edited/assigned/unassigned and comment webhooks back into threads. Mappings live in ticket-external-links/ticket-thread-external-links with integration-sync-log metadata; migration 0119 repairs existing rows' event mappings. A backfill script seeds links for existing ticket comments.
• Email (packages/email/) — templates/tickets/ticket-event.tsx renders structured sections, details and full thread snapshots; send-ticket-event-email adds the fallback delivery path.
• Integration platform — shared updates to inbound-webhook-handler, webhook-registration, oauth/oauth-handlers, save, and per-provider functions.ts (asana, jira, linear, gitlab, hubspot, intercom, notion, salesforce, trello, zendesk, clickup, discord, monday, make, n8n, zapier); ntfy integration files.
• Hardening — OAuth/webhook callback origin resolution for configured public URLs, forwarded hosts and tunnel/private origins.

How to use

• Connect GitHub: Settings → Integrations → GitHub; authorise and select the repository for ticket sync.
• Outbound: new tickets/replies create and update a GitHub issue/comments automatically.
• Inbound: changes made on the GitHub issue flow back into the ticket thread; loop-prevention stops echoes.
• Backfill existing tickets: run the GitHub ticket-comment backfill script once after connecting.
• Email: ticket emails are sent automatically on the relevant events; recipients reply by email and the thread is updated.

Safety

• Outbound sync skips events that originated from the same integration to prevent infinite loops.
• Inbound webhooks are signature/sender-verified; delivery uses the SSRF-guarded fetch path; tokens are stored encrypted; recipient email addresses are never logged.

Verification

• bun run typecheck, bun run lint; ticket-inbound.test.ts, github hook.test.ts, ticket-message builders, inbound-webhook-handler (github) and send-ticket-event-email.test.ts (included).

Depends on 05-sla-inboxes-routing.

---

📚 This is a stacked series — please review & merge in order

These 10 PRs are split by concern and ordered by dependency. Each is opened against main, so until the PRs before it have merged, a PR's diff is cumulative (it also contains the earlier batches). As the earlier PRs merge and we rebase the next branch onto main, each diff reduces to just its own batch. Merging all 10 in order reproduces our integrated branch exactly (verified: the cumulative tip of the series is byte-identical to it).

Order (by branch):

1. 01-data-model-foundation — data model, TypeIDs, migrations
2. 02-rbac-authz-teams — RBAC, teams, organisation & auth surfaces
3. 03-events-audit-webhooks — event dispatch, audit log, webhooks, notifications
4. 04-ticketing-crm-core — ticketing / CRM core
5. 05-sla-inboxes-routing — SLA policies, inboxes, business hours, routing
6. 06-github-sync-and-ticket-email — GitHub ticket sync, ticket email, integration platform
7. 07-widget-profiles — scoped widget profiles + ticket submission
8. 08-api-openapi-mcp — OpenAPI surface, MCP tools, conversation actions, API keys
9. 09-content-visibility — changelog/help-centre visibility, segments, portal tabs
10. 10-test-coverage — broad unit/integration test suite + supporting infra

Part of the roadmap: #283

[CLAassistant]

All committers have signed the CLA.