feat(trigger): add ServiceNow webhook triggers

[waleedlatif1]

Summary

• Add 5 ServiceNow webhook triggers: incident created/updated, change request created/updated, and generic webhook
• Uses buildTriggerSubBlocks helper with setup instructions for Business Rules + RESTMessageV2
• Register triggers in trigger registry and wire to existing ServiceNow block
• No provider handler needed — default handler suffices (manual webhook setup via Business Rules)

Type of Change

• New feature

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 9, 2026 8:47pm

[cursor]

PR Summary

Medium Risk
Adds new inbound webhook entry points and event-matching logic for ServiceNow, which could affect workflow execution and webhook authorization if misconfigured. Changes are mostly additive but touch the webhook provider registry and trigger wiring.

Overview
Adds five ServiceNow webhook triggers (incident created/updated, change request created/updated, and a generic “all events” webhook), including shared setup instructions, configurable webhookSecret, optional tableName filtering, and standardized trigger outputs.

Wires these triggers into the UI and execution path by updating the ServiceNow integration metadata (integrations.json), enabling triggers in servicenow.ts via getTrigger(...).subBlocks, registering them in triggers/registry.ts, and adding a new servicenow webhook provider handler that validates secrets and filters events via isServiceNowEventMatch.

^{Reviewed by Cursor Bugbot for commit 952cc69. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds 5 ServiceNow webhook triggers (incident_created, incident_updated, change_request_created, change_request_updated, and a generic webhook), a dedicated provider handler with bearer-token auth (verifyAuth) and table/event-type matching (matchEvent), wires the triggers into the existing ServiceNow block, and registers everything in the trigger and provider registries. Previous review concerns around missing authentication and non-TSDoc comments have been fully addressed.

Confidence Score: 5/5

Safe to merge — all prior security concerns are resolved and remaining findings are P2 style improvements.

The PR is well-structured, follows established patterns (Salesforce/GitHub triggers), and has addressed the two prior review issues (webhook secret auth + non-TSDoc comment). The two remaining findings are P2: a missing tableName/eventType in the setup instructions example and an unnecessary dynamic import. Neither blocks merge.

apps/sim/triggers/servicenow/utils.ts (setup instructions example payload), apps/sim/lib/webhooks/providers/servicenow.ts (dynamic import)

Vulnerabilities

• Auth is enforced in verifyAuth: rejects unconditionally when webhookSecret is not configured (no unauthenticated pass-through), and validates via timing-safe comparison against both Bearer token and X-Sim-Webhook-Secret header.
• The servicenowHandler is registered in the provider registry, preventing fallback to the unauthenticated default handler.
• No secrets are hardcoded; the webhook secret is user-supplied and stored via the standard password: true subblock.

Important Files Changed

Filename	Overview
apps/sim/triggers/servicenow/utils.ts	Core utility: setup instructions, output builders, and event-matching logic. Event matching logic is correct and handles all 5 trigger IDs; example payload is missing tableName/eventType fields that the matching logic relies on.
apps/sim/lib/webhooks/providers/servicenow.ts	New provider handler with correct auth (Bearer + X-Sim-Webhook-Secret) and event matching via delegated isServiceNowEventMatch. Uses an unnecessary dynamic import for a synchronous utility.
apps/sim/blocks/blocks/servicenow.ts	Trigger subBlocks correctly spread from all 5 trigger configs via getTrigger(); trigger IDs and tool access arrays are consistent.
apps/sim/triggers/servicenow/incident_created.ts	Primary trigger with includeDropdown: true; structure and ID match registry and block config correctly.
apps/sim/triggers/registry.ts	All 5 ServiceNow triggers registered correctly; imports are alphabetically placed in the right section.
apps/sim/lib/webhooks/providers/registry.ts	servicenowHandler correctly registered under the 'servicenow' key; no longer falls through to the unauthenticated default handler.

_{Reviews (2): Last reviewed commit: "lint" | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 952cc69. Configure here.}