feat(clickup): webhook triggers, hierarchy selectors, and Docs knowledge-base connector

[waleedlatif1]

Summary

• Adds 29 ClickUp webhook triggers (all 28 documented events + a generic catch-all) with fully automatic webhook lifecycle: created in ClickUp on deploy, deleted on undeploy, HMAC-SHA256 (X-Signature) verified fail-closed with the per-webhook secret, and idempotency keyed on ClickUp's documented webhook_id:history_item_id
• Optional location scoping per trigger (space/folder/list/task) mapped to ClickUp's create-webhook filters
• Adds clickup.workspaces/spaces/folders/lists selectors (contracts + routes + selector registry) and wires them into the ClickUp block Linear/Monday-style: basic-mode Workspace/Space/Folder/List dropdowns with advanced manual ID inputs (canonical pairs), replacing the raw ID short-inputs
• Adds a ClickUp Docs knowledge-base connector (Docs API v3: Search Docs + Fetch Doc + Fetch Pages as markdown), contentDeferred stubs with metadata-based hashes, cursor pagination, maxDocs cap with precise listingCapped semantics, and workspace/space selector config fields
• Adds SUBBLOCK_ID_MIGRATIONS entries for the renamed block subblock IDs and fixes the inert check-block-registry subblock-stability regex (missed BlockConfig generics repo-wide)
• Provider handler test suite (23 tests) covering auth, event matching, idempotency, formatInput alignment, and the subscription lifecycle incl. no-secret rollback

Type of Change

• New feature

Testing

• bun run type-check, check:api-validation:strict, monorepo boundary checks, and docs generation all pass
• New clickup provider tests (23) plus the full webhook provider/orchestration suites (421 tests) pass
• Validated against ClickUp's live API reference (events, payloads, signature scheme, create/delete webhook, Docs v3 shapes) via /validate-trigger, /validate-integration, and /validate-connector passes

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 16, 2026 9:19am

[cursor]

PR Summary

Medium Risk
Large new surface (webhook ingress, OAuth-backed subscription lifecycle, and external API calls) with security-sensitive signature verification; mitigated by extensive provider tests and established patterns from other integrations.

Overview
Adds 29 ClickUp workflow triggers (task/list/folder/space/goal/key-result events plus a catch-all) with a new webhook provider: ClickUp webhooks are created on deploy and removed on undeploy, verified with HMAC X-Signature (fail-closed), filtered by trigger type, and deduped via ClickUp’s webhook_id:history_item_id key. Trigger config supports optional workspace/space/folder/list/task scoping.

The ClickUp block is now trigger-capable and replaces raw hierarchy ID fields with basic-mode selectors (workspace → space → folder → list) backed by four new selector API routes and contracts; advanced manual IDs remain. teamId is the canonical workspace param (with subblock ID migrations for saved workflows).

Introduces a ClickUp Docs knowledge-base connector (API v3 search/list, deferred content fetch, page tree → markdown, cursor pagination, optional maxDocs cap).

Docs and integrations.json are updated for triggers; API route count baseline bumps by four; block-registry check regex handles BlockConfig<T> generics.

^{Reviewed by Cursor Bugbot for commit 874791e. Configure here.}

[greptile-apps]

Greptile Summary

This PR expands the ClickUp integration with triggers, hierarchy selectors, and Docs ingestion. The main changes are:

• Adds webhook triggers with signature verification, event filtering, idempotency, and subscription cleanup.
• Adds workspace, space, folder, and list selectors with canonical manual-ID fields.
• Adds a ClickUp Docs knowledge-base connector with pagination and deferred content fetching.
• Adds workflow migrations, registry updates, API routes, documentation, and provider tests.

Confidence Score: 5/5

This looks safe to merge.

• The list-parent fields now enforce the required folder or space input in both selector modes.
• The list-space migration now uses a separate target and preserves the saved parent value.
• Failed webhook rollback reports the external webhook ID for manual cleanup.
• No blocking issues remain in the reviewed fixes.

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/clickup.ts	Adds ClickUp hierarchy selectors and triggers while restoring conditional parent requirements for list operations.
apps/sim/lib/workflows/migrations/subblock-migrations.ts	Migrates renamed ClickUp hierarchy fields to separate selector targets.
apps/sim/lib/webhooks/providers/clickup.ts	Implements ClickUp webhook verification, subscription lifecycle handling, and explicit rollback failure reporting.
apps/sim/connectors/clickup/clickup.ts	Adds ClickUp Docs listing and deferred document content retrieval.

_{Reviews (3): Last reviewed commit: "fix(clickup): clickup.lists selector acc..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 874791e. Configure here.}