Harden webhook processing and visibility

[BotCoder254]

Adds webhook delivery idempotency for pipeline creation by storing webhook_delivery_id and enforcing one pipeline per (delivery, workflow), preventing duplicate runs/checks on retries. Webhook processing now fans out correctly to all workspace connections of the same GitHub repo, records per-workspace timeline events, and exposes deployment-wide webhook signature rejection health in API/UI (new sync KPI and empty-timeline remediation state). Also raises webhook body/rate limits to match real GitHub payload behavior and adds a runbook for diagnosing 401 webhook rejections.

Summary by CodeRabbit

• New Features

  • Webhook deliveries now avoid creating duplicate pipelines and checks when retried.
  • Events fan out across all connected workspaces for the same repository.
  • Repository health now shows webhook signature-rejection counts, timing, and causes.
  • Added a webhook authentication warning state with remediation guidance.
  • Webhook requests support GitHub’s payload size limits and improved throughput.

• Bug Fixes

  • Improved handling of failed signatures, repository events, deletions, and webhook retries.
  • Added validation for workspace names used in GitHub links.

• Documentation

  • Added a runbook for diagnosing empty timelines caused by webhook authentication failures.

[netlify]

✅ Deploy Preview for overup-app ready!

Name	Link
🔨 Latest commit	cc685c9
🔍 Latest deploy log	https://app.netlify.com/projects/overup-app/deploys/6a5a686651ee5a0008863b4b
😎 Deploy Preview	https://deploy-preview-45--overup-app.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
overup	Ready	Preview, Comment	Jul 17, 2026 5:37pm

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 2afe911d-51b7-49ea-ab2f-b76eee970b79

📥 Commits

Reviewing files that changed from the base of the PR and between b751519 and cc685c9.

📒 Files selected for processing (21)

• CLAUDE.md
• backend/migrations/20260717100001_pipeline_delivery_idempotency.sql
• backend/src/db/pipelines.rs
• backend/src/db/repositories.rs
• backend/src/db/webhook_deliveries.rs
• backend/src/handlers/github_webhooks.rs
• backend/src/handlers/pipelines.rs
• backend/src/handlers/repositories.rs
• backend/src/models/repository.rs
• backend/src/routes/mod.rs
• backend/src/services/github_checks.rs
• backend/src/services/mod.rs
• backend/src/services/pipeline_run.rs
• backend/src/services/webhook_processor.rs
• backend/src/services/webhook_stats.rs
• backend/src/state.rs
• docs/fix-webhook-401-empty-timeline.md
• src/features/repositories/components/RepositoryEventsList.tsx
• src/features/repositories/components/RepositorySyncPanel.tsx
• src/features/repositories/pages/RepositoryDetailPage.tsx
• src/types/repository.ts

---

📝 Walkthrough

Walkthrough

Webhook handling now fans out across connected repositories, prevents duplicate workflow pipelines per delivery, tracks signature failures, exposes webhook health, and presents rejection diagnostics in the repository UI. Webhook body limits, rate limits, URL validation, and operational documentation were also updated.

Changes

Webhook reliability

Layer / File(s)	Summary
Signature rejection telemetry and health contract backend/src/services/webhook_stats.rs, backend/src/state.rs, backend/src/handlers/github_webhooks.rs, backend/src/models/repository.rs, backend/src/handlers/repositories.rs, src/types/repository.ts	Signature failures are categorized and tracked in shared state, then returned as nested repository health data with rolling counts, timestamps, and causes.
Delivery-idempotent pipeline creation backend/migrations/20260717100001_pipeline_delivery_idempotency.sql, backend/src/db/pipelines.rs, backend/src/services/pipeline_run.rs, backend/src/services/webhook_processor.rs, backend/src/handlers/pipelines.rs	Webhook delivery IDs are persisted and uniquely constrained per workflow; duplicate deliveries reuse the existing pipeline and avoid duplicate scheduler updates or check runs.
Multi-connection webhook processing backend/src/db/repositories.rs, backend/src/services/webhook_processor.rs, backend/src/db/webhook_deliveries.rs	Push, pull request, repository, failure, and installation-removal processing now fans out deterministically across all connected repository records.
Webhook ingress limits and operational guidance backend/src/routes/mod.rs, backend/src/services/github_checks.rs, CLAUDE.md, docs/fix-webhook-401-empty-timeline.md	Webhook requests use a dedicated 25 MiB body limit and adjusted rate limits; workspace slug validation and signature-failure remediation guidance were added.
Repository webhook health presentation src/features/repositories/components/RepositorySyncPanel.tsx, src/features/repositories/components/RepositoryEventsList.tsx, src/features/repositories/pages/RepositoryDetailPage.tsx	The repository UI displays webhook-auth KPIs and a signature-rejection warning state with cause-specific remediation details.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHub
  participant WebhookEndpoint
  participant WebhookAuthStats
  participant RepositoryHealth
  participant RepositoryUI
  GitHub->>WebhookEndpoint: Send signed webhook
  WebhookEndpoint->>WebhookAuthStats: Record rejection cause when verification fails
  RepositoryHealth->>WebhookAuthStats: Snapshot rejection metrics
  RepositoryUI->>RepositoryHealth: Load repository health
  RepositoryHealth-->>RepositoryUI: Return webhook-auth status

Loading

sequenceDiagram
  participant WebhookProcessor
  participant RepositoryLookup
  participant PipelineRun
  participant PipelineStore
  participant CheckRuns
  WebhookProcessor->>RepositoryLookup: Find all connected repositories
  RepositoryLookup-->>WebhookProcessor: Return ordered repository connections
  WebhookProcessor->>PipelineRun: Create workflow pipeline with delivery ID
  PipelineRun->>PipelineStore: Insert or retrieve idempotent pipeline
  PipelineStore-->>PipelineRun: Return pipeline and newly_created
  PipelineRun->>CheckRuns: Create check run only when newly_created

Loading

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

This PR successfully implements webhook delivery idempotency and multi-workspace fan-out processing with strong architectural design. The implementation includes proper security controls (constant-time HMAC verification, input sanitization), comprehensive test coverage, and effective race condition handling through database constraints. The webhook signature rejection tracking provides valuable observability for diagnosing misconfigurations. The code is production-ready with no blocking defects identified.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.