Put the Slack webhooks endpoint behind Bolt

[suhaibmujahid]

Resolves #6890

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[ayoubdiourin7]

LGTM !

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical listener-routing and test-collection failures remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

• Legacy Slack webhook test causes pytest collection failure · New
• Incorrect action type prevents Slack button listener matching · New

What changed in this PR

Migrates Slack interactivity handling from custom FastAPI parsing to Slack Bolt through /webhooks/slack.

Changes:

• Adds Bolt app wiring, action listeners, configuration, dependencies, and tests.
• Updates Slack manifest and documentation.
• Removes the legacy Slack router, payload models, and signature verifier.

File	Summary
uv.lock	Locks new Bolt and aiohttp dependencies.
services/​hackbot-api/​tests/​test_slack_listeners.py	Tests Slack action callbacks.
services/​hackbot-api/​tests/​test_slack_interactions.py	Tests Bolt request handling and authentication.
services/​hackbot-api/​tests/​conftest.py	Provides test Slack configuration.
services/​hackbot-api/​pyproject.toml	Adds Slack runtime dependencies.
services/​hackbot-api/​manifest.json	Configures Slack interactivity.
services/​hackbot-api/​app/​slack/​listeners/​actions/​start_agent_run.py	Handles agent-run button clicks.
services/​hackbot-api/​app/​slack/​listeners/​actions/​__init__.py	Registers action listeners; the type constraint prevents Slack button actions from matching (critical, 2 votes).
services/​hackbot-api/​app/​slack/​listeners/​__init__.py	Registers listener groups.
services/​hackbot-api/​app/​slack/​app.py	Builds the Bolt app and FastAPI handler; unmatched actions currently produce a 500 instead of the expected 404 (moderate, 1 vote).
services/​hackbot-api/​app/​slack/​__init__.py	Adds the Slack package marker.
services/​hackbot-api/​app/​slack_webhook.py	Removes custom Slack payload models.
services/​hackbot-api/​app/​routers/​webhooks.py	Adds the Bolt-backed webhook endpoint.
services/​hackbot-api/​app/​routers/​slack.py	Removes the legacy router, but an existing test still imports it and causes collection failure (critical, 1 vote).
services/​hackbot-api/​app/​routers/​__init__.py	Removes legacy router exports; the existing test still imports removed symbols and fails collection (critical, 2 votes).
services/​hackbot-api/​app/​main.py	Removes legacy router registration.
services/​hackbot-api/​app/​config.py	Adds Slack bot-token configuration.
services/​hackbot-api/​app/​auth.py	Removes custom Slack signature verification.
docs/​hackbot/​security.md	Documents Bolt-based Slack authentication.
docs/​hackbot/​deployment.md	Updates deployment configuration guidance.
docs/​hackbot/​api.md	Documents the new endpoint; its event-handling description is inaccurate because only interactivity payloads are supported (nit, 1 vote).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.