feat(clickup): webhook triggers, hierarchy selectors, and Docs knowledge-base connector

[waleedlatif1]

Summary

• Adds 29 ClickUp webhook triggers (all 28 documented events + a generic catch-all) with fully automatic webhook lifecycle: created in ClickUp on deploy, deleted on undeploy, HMAC-SHA256 (X-Signature) verified fail-closed with the per-webhook secret, and idempotency keyed on ClickUp's documented webhook_id:history_item_id
• Optional location scoping per trigger (space/folder/list/task) mapped to ClickUp's create-webhook filters
• Adds clickup.workspaces/spaces/folders/lists selectors (contracts + routes + selector registry) and wires them into the ClickUp block Linear/Monday-style: basic-mode Workspace/Space/Folder/List dropdowns with advanced manual ID inputs (canonical pairs), replacing the raw ID short-inputs
• Adds a ClickUp Docs knowledge-base connector (Docs API v3: Search Docs + Fetch Doc + Fetch Pages as markdown), contentDeferred stubs with metadata-based hashes, cursor pagination, maxDocs cap with precise listingCapped semantics, and workspace/space selector config fields
• Adds SUBBLOCK_ID_MIGRATIONS entries for the renamed block subblock IDs and fixes the inert check-block-registry subblock-stability regex (missed BlockConfig generics repo-wide)
• Provider handler test suite (23 tests) covering auth, event matching, idempotency, formatInput alignment, and the subscription lifecycle incl. no-secret rollback

Type of Change

• New feature

Testing

• bun run type-check, check:api-validation:strict, monorepo boundary checks, and docs generation all pass
• New clickup provider tests (23) plus the full webhook provider/orchestration suites (421 tests) pass
• Validated against ClickUp's live API reference (events, payloads, signature scheme, create/delete webhook, Docs v3 shapes) via /validate-trigger, /validate-integration, and /validate-connector passes

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 16, 2026 5:20pm

[cursor]

PR Summary

Medium Risk
Inbound webhooks and OAuth-backed subscription lifecycle are security-sensitive, and renaming ClickUp block subblock IDs relies on migrations for existing workflows.

Overview
Expands ClickUp with 29 webhook triggers (task/list/folder/space/goal/key-result events plus a catch-all), a clickup webhook provider that registers subscriptions in ClickUp on deploy, verifies X-Signature HMAC fail-closed, dedupes on webhook_id:history_item_id, and tears down on undeploy (with rollback if no signing secret is returned).

The ClickUp block is now trigger-capable and replaces raw workspace/space/folder/list ID fields with basic/advanced project selectors backed by new /api/tools/clickup/* routes, contracts, and selector hooks; teamId is the canonical workspace param with subblock ID migrations for saved workflows.

Adds a ClickUp Docs knowledge connector (v3 Search/Fetch, deferred content, optional space filter and maxDocs cap) and documents triggers in clickup.mdx / integrations.json.

^{Reviewed by Cursor Bugbot for commit 8726018. Configure here.}

[greptile-apps]

Greptile Summary

This PR expands the ClickUp integration with event triggers, hierarchy selectors, and Docs ingestion. The main changes are:

• Adds 29 ClickUp webhook triggers with signature verification, idempotency, and subscription cleanup.
• Adds workspace, space, folder, and list selectors with workflow migrations for renamed fields.
• Adds a ClickUp Docs knowledge-base connector with deferred content fetching and pagination.
• Adds provider tests and updates integration documentation and registries.

Confidence Score: 5/5

This looks safe to merge.

• The list-parent fields now validate the correct canonical values.
• The migration keeps the list-space value separate from the general space value.
• Failed webhook rollback reports the external webhook ID for manual cleanup.
• No blocking issues remain in the reviewed fixes.

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/clickup.ts	Adds hierarchy selectors and ClickUp trigger registration, including corrected list-parent requirements.
apps/sim/lib/workflows/migrations/subblock-migrations.ts	Migrates legacy ClickUp hierarchy fields without merging the list-space and space values.
apps/sim/lib/workflows/subblocks/context.ts	Exposes the canonical list-space value to selector context construction.
apps/sim/lib/webhooks/providers/clickup.ts	Adds ClickUp webhook lifecycle, signature verification, event matching, and rollback handling.
apps/sim/connectors/clickup/clickup.ts	Adds ClickUp Docs discovery and deferred content retrieval with pagination and listing limits.

_{Reviews (5): Last reviewed commit: "fix(clickup): integer-only maxDocs and l..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 874791e. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8437acf. Configure here.}

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8726018. Configure here.}