feat(orchestration): event-driven webhook queue, trigger evaluation, PR/tag pipelines, Checks reporting, repo event timeline

[BotCoder254]

Summary

Ships the event-driven orchestration layer: GitHub becomes purely the event source and repository provider, while overup remains the complete CI/CD control plane. The webhook endpoint now does verification → validation → durable persistence → 202 ack ONLY (GitHub's 10-second budget), and every side effect — sync scheduling, trigger evaluation, pipeline creation, timeline writes, Checks reporting — runs asynchronously off the request path.

Architecture

• Durable webhook queue — webhook_deliveries becomes a queue: normalized server-built payload JSONB (never the raw body), pending|processing|processed|ignored|failed lifecycle, retry_count (migration 20260717000001). Events from repositories not connected to any workspace are discarded before any processing.
• Background processor (services/webhook_processor.rs) — sequential FOR UPDATE SKIP LOCKED consumer (poke + 2 s tick) preserving per-repo ordering; ≤3 retries, 5-min stuck-row revert, payload nulling on terminal states so the table stays bounded; a manual GitHub redelivery revives a terminally failed row. Timeline row + delivery status flip commit in one transaction.
• Trigger evaluation (services/trigger_eval.rs, pure/bounded) — parser v3 extracts on.push/on.pull_request filters into workflows.metadata.triggerFilters; hand-rolled GitHub-flavored glob (*, **, ?/+, [a-z], \ escapes, ordered ! negation, last match wins) with no regex and no recursion; branch AND path dimensions must both pass, paths never apply to tag pushes, truncated changed-path sets fail OPEN on path filters only. Skips are recorded per-workflow with static reasons.
• PR + tag pipelines — trigger vocabulary is now push|manual|pull_request|tag (+ pipelines.pr_number); PR head SHAs build under refs/pull/{n}/head; fork PRs are skipped with static fork_pr_skipped (secrets never flow to fork code); refs/tags/ pushes run on: push workflows as trigger tag. Cron stays parse/display-only.
• Checks API reporting (services/github_checks.rs) — event-triggered pipelines surface as GitHub check runs (queued → in_progress → completed, details_url → the pipeline page; static templates + job counts, never runner text). A separate checks:write installation token keeps the sync token read-only; 403/422 parks the installation for 1 h with one edge-triggered warn; GITHUB_CHECKS_ENABLED (default true) gates it. Manual dispatches never report.
• Repository timeline + health — immutable repository_events (outcome CHECK, static ignored_reason, pipeline_ids[], capped summary) feeds a keyset GET …/repositories/{id}/events and a health object on the repo detail response.

UI (same design system throughout)

• RepositorySyncPanel — KPI strip (Auto-sync, Last event, Pending, Failed 24 h, GitHub checks) between the repo meta strip and tabs; identical to the dashboard KpiStrip pattern.
• RepositoryEventsList — new Events tab: ActivityFeed-style compact rows, outcome badges, ref/PR/tag chips, skip tooltips, pipeline links, IntersectionObserver infinite scroll with Load-more fallback.
• Pipelines UI — pull_request/tag trigger filter options + icons, PR # link on the Metadata tab, branchOfRef renders tag and PR #n refs.

Hardening fixes applied in review

• Fast-pipeline check-run race — a pipeline finishing before the async check-run create persisted its id would leave the GitHub check stuck at queued; completion now falls back to creating the check run directly in completed status.
• Terminal-failure observability — a delivery whose completion COMMIT fails at the retry cap now also records a failed repository timeline row (previously only processing errors did).
• Removed a stale #[allow(dead_code)] on ClaimedDelivery.installation_id.

Security notes

• Constant-time HMAC over the raw body before any parsing; raw body never persisted or logged; payload strings capped, changed paths deduped/capped at 300 with a truncation flag; avatars https-only.
• outcome/ignored_reason/skip reasons are static category strings, CHECK-enforced in SQL.
• Owner/repo re-validated against the segment allow-list before Checks URL interpolation; upstream response bodies never logged (status only).
• Dedicated per-IP governor stays on /webhooks; replay protection = delivery-id idempotency (GitHub does not sign a timestamp).

Deliberately deferred (follow-ups)

Workflow version archiving, concurrency groups, cron/schedule dispatch, release/deployment/check_suite rerequested events, Commit Status API fallback when Checks is unavailable.

Verification

• cargo check, cargo clippy -- -D warnings, cargo test (190 passed) in backend/
• npm run build — compiled successfully

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added support for pull request and tag-triggered pipelines, including trigger filtering and improved pipeline details.
  • Added GitHub Checks reporting for event-triggered pipelines, configurable through GITHUB_CHECKS_ENABLED.
  • Added repository health indicators and an Events tab with a searchable, continuously loading webhook timeline.
  • Added support for branch, tag, path, and pull request activity filters in workflow triggers.

• Bug Fixes

  • Improved webhook reliability with background processing, retry handling, and crash recovery.
  • Preserved pull request information when rerunning pipelines.

• Documentation

  • Updated GitHub App setup guidance and documented event processing and Checks permissions.

[netlify]

✅ Deploy Preview for overup-app ready!

Name	Link
🔨 Latest commit	7c9c69f
🔍 Latest deploy log	https://app.netlify.com/projects/overup-app/deploys/6a596e292687b1000881547b
😎 Deploy Preview	https://deploy-preview-39--overup-app.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 3a518cc0-4899-491c-bce7-bfc0decd6dda

📥 Commits

Reviewing files that changed from the base of the PR and between b5792a6 and 7c9c69f.

📒 Files selected for processing (38)

• CLAUDE.md
• backend/.env.example
• backend/migrations/20260717000001_webhook_async_and_repo_events.sql
• backend/src/config.rs
• backend/src/db/mod.rs
• backend/src/db/pipelines.rs
• backend/src/db/repository_events.rs
• backend/src/db/webhook_deliveries.rs
• backend/src/db/workflows.rs
• backend/src/handlers/github_webhooks.rs
• backend/src/handlers/pipelines.rs
• backend/src/handlers/repositories.rs
• backend/src/main.rs
• backend/src/models/pipeline.rs
• backend/src/models/repository.rs
• backend/src/routes/mod.rs
• backend/src/services/github_app.rs
• backend/src/services/github_checks.rs
• backend/src/services/mod.rs
• backend/src/services/pipeline_run.rs
• backend/src/services/repo_sync.rs
• backend/src/services/trigger_eval.rs
• backend/src/services/webhook_processor.rs
• backend/src/services/workflow_parse.rs
• backend/src/state.rs
• src/features/pipelines/components/JobIdentityBar.tsx
• src/features/pipelines/components/PipelineFilters.tsx
• src/features/pipelines/components/PipelinesTable.tsx
• src/features/pipelines/components/panels/MetadataPanel.tsx
• src/features/pipelines/lib/format.ts
• src/features/pipelines/pages/PipelinesPage.tsx
• src/features/repositories/api/repositoriesApi.ts
• src/features/repositories/components/RepositoryEventsList.tsx
• src/features/repositories/components/RepositorySyncPanel.tsx
• src/features/repositories/hooks/useRepositories.ts
• src/features/repositories/pages/RepositoryDetailPage.tsx
• src/types/pipeline.ts
• src/types/repository.ts

---

📝 Walkthrough

Walkthrough

This change adds durable asynchronous webhook orchestration, GitHub-style trigger evaluation, pipeline Checks reporting, immutable repository event history and health APIs, and frontend repository and pipeline displays for pull request and tag triggers.

Changes

Event orchestration

Layer / File(s)	Summary
Storage contracts and trigger evaluation backend/migrations/..., backend/src/db/..., backend/src/services/workflow_parse.rs, backend/src/services/trigger_eval.rs	Adds webhook and repository event storage, PR/tag pipeline fields, parsed trigger filters, bounded glob evaluation, and trigger decision categories.
Durable webhook intake and processing backend/src/handlers/github_webhooks.rs, backend/src/db/webhook_deliveries.rs, backend/src/services/webhook_processor.rs, backend/src/main.rs	Normalizes and queues webhook payloads, acknowledges with 202, drains deliveries asynchronously, handles retries and stuck rows, and records timeline outcomes transactionally.
Pipeline linkage and GitHub Checks reporting backend/src/services/github_app.rs, backend/src/services/github_checks.rs, backend/src/services/pipeline_run.rs, backend/src/models/pipeline.rs	Persists PR and check-run identifiers, mints scoped Checks tokens, and reports queued, started, and completed event-triggered pipelines.
Repository event API and health data backend/src/handlers/repositories.rs, backend/src/db/repository_events.rs, backend/src/routes/mod.rs, src/features/repositories/..., src/types/repository.ts	Adds repository health data and cursor-paginated event endpoints, hooks, a sync KPI panel, and an infinite-scroll Events tab.
Pipeline trigger and reference presentation src/types/pipeline.ts, src/features/pipelines/components/*, src/features/pipelines/lib/format.ts, src/features/pipelines/pages/PipelinesPage.tsx	Adds pull request and tag trigger types, filters, icons, labels, PR links, ref formatting, and updated empty-state text.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHub
  participant WebhookReceiver
  participant WebhookQueue
  participant WebhookProcessor
  participant PipelineRun
  participant GitHubChecks
  GitHub->>WebhookReceiver: Send verified webhook
  WebhookReceiver->>WebhookQueue: Persist normalized payload
  WebhookReceiver-->>GitHub: Return 202 Accepted
  WebhookProcessor->>WebhookQueue: Claim delivery
  WebhookProcessor->>PipelineRun: Evaluate triggers and create pipelines
  PipelineRun->>GitHubChecks: Report lifecycle phase
  GitHubChecks->>GitHub: Create or update check run

Loading

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

This PR successfully delivers the event-driven orchestration layer with solid security practices and thorough implementation. The webhook handler properly performs constant-time HMAC verification, caps all inputs, and sanitizes data before persistence. The asynchronous processor maintains per-repo ordering guarantees while handling retries and crash recovery. The trigger evaluation uses bounded iterative glob matching to prevent DoS attacks. Fork PR protection is correctly implemented, and all paths are validated before URL interpolation. The codebase is well-tested with 190 passing tests and demonstrates production-ready quality.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

---

⚠️ This PR contains more than 30 files. Amazon Q is better at reviewing smaller PRs, and may miss issues in larger changesets.