Skip to content
Sign up

flagon-io/g1t

public
0

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp
309 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Fixes from the page sweep1//! The webhooks service: events, delivered to the addresses a repository or
2//! a workspace registers.
3//!
4//! Every event g1t publishes can be delivered: an HTTPS `POST` of JSON,
5//! signed with the webhook's secret in `X-G1t-Signature-256`, and retried
6//! with growing waits when the receiver does not answer with a 2xx. Each
7//! delivery is kept, with what was sent and what came back, and can be sent
8//! again.
9//!
10//! Mirrors `packages/contracts/src/webhooks.ts`.
11
12use serde::{Deserialize, Serialize};
13
14use crate::repos::RepoPath;
15use crate::{User, Viewer};
16
17/// Every event a webhook can be sent, in the order people are shown them.
Merge branch 'worktree-agent-ab8033ab973f8d99a'18pub const EVENT_TYPES: [&str; 110] = [
Fixes from the page sweep19 "git.push",
Merge branch 'worktree-agent-a8b78c62188153aa3' into claude/cool-newton-7nm8r920 "git.deleted",
Fixes from the page sweep21 "branch.renamed",
22 "repo.created",
23 "repo.forked",
24 "repo.updated",
25 "repo.visibility_changed",
26 "repo.renamed",
27 "repo.transferred",
28 "repo.default_branch_changed",
29 "repo.archived",
30 "repo.unarchived",
31 "repo.deleted",
32 "repo.restored",
33 "repo.purged",
34 "repo.collaborator_added",
35 "repo.collaborator_removed",
36 "repo.collaborator_role_changed",
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar37 "team.created",
38 "team.edited",
39 "team.deleted",
40 "team.member_added",
41 "team.member_role_changed",
42 "team.member_removed",
43 "team.repo_added",
44 "team.repo_role_changed",
45 "team.repo_removed",
@g1t welcomes you when you join a workspace, and that is the one introduction any agent makes. Identity now says when a person becomes a member, workspace.member_joined, by invitation, by an invite code, or by creating the workspace, and webhooks can hear it; the agents service hears it too, and for anyone who joined, never the creator, the workspace's @g1t opens your direct message and says in its own voice who it is, what to ask it, how agents answer, and where things are, once per person per workspace and charged to @g1t like any reply, with a fixed welcome when no model can be used. The agents, workspaces, authentication and webhooks guides say so.46 "workspace.member_joined",
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge47 "ruleset.created",
48 "ruleset.updated",
49 "ruleset.deleted",
Fixes from the page sweep50 "issue.opened",
51 "issue.updated",
52 "issue.assigned",
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar53 "issue.labeled",
54 "issue.unlabeled",
55 "issue.milestoned",
56 "issue.demilestoned",
Fixes from the page sweep57 "issue.closed",
58 "issue.reopened",
59 "comment.created",
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts60 "comment.edited",
61 "comment.deleted",
Fixes from the page sweep62 "pull.opened",
63 "pull.ready",
64 "pull.updated",
65 "pull.merge_requested",
66 "pull.merged",
67 "pull.closed",
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts68 "pull.reopened",
69 "pull.converted_to_draft",
Events: review requests, assignments, stops and deployments are published70 "pull.assigned",
71 "pull.review_requested",
72 "pull.review_request_removed",
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar73 "pull.labeled",
74 "pull.unlabeled",
75 "pull.milestoned",
76 "pull.demilestoned",
77 "pull.base_changed",
Events: review requests, assignments, stops and deployments are published78 "pull.stalled",
79 "pull.resumed",
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts80 "release.created",
81 "release.published",
82 "release.released",
83 "release.prereleased",
84 "release.edited",
85 "release.unpublished",
86 "release.deleted",
Fixes from the page sweep87 "checks.completed",
Merge checks: statuses and check runs on every commit88 "status.created",
89 "check_run.created",
90 "check_run.completed",
91 "check_run.rerequested",
92 "check_run.requested_action",
93 "check_suite.completed",
94 "check_suite.rerequested",
Fixes from the page sweep95 "workflow.completed",
Events: review requests, assignments, stops and deployments are published96 "deployment.succeeded",
97 "deployment.failed",
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb9798 "deployment.created",
99 "deployment_status.created",
Fixes from the page sweep100 "queue.changed",
Merge branch 'worktree-agent-ab8033ab973f8d99a'101 "integration.failed",
102 "integration.passed",
103 "decision.recorded",
Fixes from the page sweep104 "session.appended",
105 "package.published",
106 "package.version_deleted",
107 "package.deleted",
108 "package.visibility_changed",
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar109 "secret_scanning_alert.created",
110 "secret_scanning_alert.fixed",
111 "secret_scanning_alert.dismissed",
112 "secret_scanning_alert.reopened",
113 "secret_scanning.bypass_requested",
114 "secret_scanning.bypass_reviewed",
115 "code_scanning_alert.created",
116 "code_scanning_alert.fixed",
117 "code_scanning_alert.dismissed",
118 "code_scanning_alert.reopened",
119 "vulnerability_alert.created",
120 "vulnerability_alert.fixed",
121 "vulnerability_alert.dismissed",
Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9122 "secret_scanning_alert.summary",
123 "code_scanning_alert.summary",
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar124 "vulnerability_alert.reopened",
Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9125 "vulnerability_alert.summary",
126 "security_advisory.published",
127 "security_advisory.withdrawn",
128 "security_advisory.reported",
Fixes from the page sweep129];
130
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.131/// Event types webhooks were once offered that g1t no longer sends: they
132/// came from g1t's own agents, since removed. A webhook saved with one
133/// still reads, and saving its list again leaves them out.
134pub const RETIRED_EVENT_TYPES: [&str; 2] = ["agent.asked", "review.completed"];
135
Fixes from the page sweep136/// What a webhook belongs to.
137#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
138#[serde(rename_all = "snake_case")]
139pub enum HookScope {
140 /// One repository's events.
141 Repo,
142 /// The events of every repository in a workspace.
143 Workspace,
144}
145
146#[derive(Clone, Debug, Serialize, Deserialize)]
147#[serde(rename_all = "camelCase")]
148pub struct Hook {
149 pub id: String,
150 pub scope: HookScope,
151 pub workspace: String,
152 /// For a repository's webhook: `owner/name`.
153 pub repo: Option<String>,
154 pub url: String,
155 /// The event types it is sent, or `["*"]` for all.
156 pub events: Vec<String>,
157 pub active: bool,
158 /// The last four characters of its secret.
159 pub secret_hint: String,
160 pub created_by: String,
161 /// RFC 3339.
162 pub created_at: String,
163 /// How its latest delivery went: `delivered`, `pending` or `failed`.
164 pub last_status: Option<String>,
165 pub last_delivered_at: Option<String>,
166}
167
168/// One event sent, or being sent, to a webhook.
169#[derive(Clone, Debug, Serialize, Deserialize)]
170#[serde(rename_all = "camelCase")]
171pub struct HookDelivery {
172 pub id: String,
173 pub hook_id: String,
174 /// The event's id, or empty for a ping.
175 pub event_id: String,
176 pub event: String,
177 /// `pending` while it will be tried again, `delivered`, or `failed` once
178 /// it has been tried as often as it will be.
179 pub status: String,
180 pub attempts: u32,
181 /// The receiver's HTTP status, the last time it answered.
182 pub response_status: Option<u16>,
183 /// The start of what it answered.
184 pub response_body: Option<String>,
185 /// Why the last attempt failed, when the receiver could not be reached.
186 pub error: Option<String>,
187 pub duration_ms: Option<u32>,
188 /// The JSON that was sent.
189 pub payload: String,
190 /// RFC 3339.
191 pub created_at: String,
192 pub delivered_at: Option<String>,
193 pub next_attempt_at: Option<String>,
194}
195
196/// Which webhooks a call is about: a repository's, or with `repo` left out,
197/// the workspace's own.
198#[derive(Clone, Debug, Serialize, Deserialize)]
199pub struct HookOwner {
200 pub workspace: String,
201 #[serde(default)]
202 pub repo: Option<RepoPath>,
203}
204
205/// `list`. Returns `Outcome<Vec<Hook>>`. Members of the workspace only.
206#[derive(Debug, Serialize, Deserialize)]
207pub struct ListArgs {
208 pub viewer: Viewer,
209 #[serde(flatten)]
210 pub owner: HookOwner,
211}
212
213/// `create`. Returns `Outcome<CreatedHook>`. Members, for a repository's
214/// webhooks; owners, for the workspace's.
215#[derive(Debug, Serialize, Deserialize)]
216pub struct CreateArgs {
217 pub actor: User,
218 #[serde(flatten)]
219 pub owner: HookOwner,
220 pub url: String,
221 /// Event types, or `["*"]` for all. All when empty.
222 #[serde(default)]
223 pub events: Vec<String>,
224 /// Made by g1t when left out.
225 #[serde(default)]
226 pub secret: Option<String>,
227}
228
229#[derive(Clone, Debug, Serialize, Deserialize)]
230pub struct CreatedHook {
231 pub hook: Hook,
232 /// The secret, when g1t made it: shown this once.
233 pub secret: Option<String>,
234}
235
236/// `update`: only the fields given change. Returns `Outcome<Hook>`.
237#[derive(Debug, Serialize, Deserialize)]
238pub struct UpdateArgs {
239 pub actor: User,
240 #[serde(flatten)]
241 pub owner: HookOwner,
242 pub id: String,
243 #[serde(default)]
244 pub url: Option<String>,
245 #[serde(default)]
246 pub events: Option<Vec<String>>,
247 #[serde(default)]
248 pub active: Option<bool>,
249}
250
251/// `delete` (returns `Outcome<bool>`) and `ping` (sends a `ping` event and
252/// returns `Outcome<HookDelivery>`).
253#[derive(Debug, Serialize, Deserialize)]
254pub struct HookArgs {
255 pub actor: User,
256 #[serde(flatten)]
257 pub owner: HookOwner,
258 pub id: String,
259}
260
261/// `deliveries`: a webhook's latest deliveries, newest first. Returns
262/// `Outcome<Vec<HookDelivery>>`.
263#[derive(Debug, Serialize, Deserialize)]
264pub struct DeliveriesArgs {
265 pub viewer: Viewer,
266 #[serde(flatten)]
267 pub owner: HookOwner,
268 pub id: String,
269}
270
271/// `redeliver`: sends a delivery's payload again, as a new delivery.
272/// Returns `Outcome<HookDelivery>`.
273#[derive(Debug, Serialize, Deserialize)]
274#[serde(rename_all = "camelCase")]
275pub struct RedeliverArgs {
276 pub actor: User,
277 #[serde(flatten)]
278 pub owner: HookOwner,
279 pub delivery_id: String,
280}
281
282#[cfg(test)]
283mod tests {
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.284 use super::{EVENT_TYPES, RETIRED_EVENT_TYPES};
285
286 #[test]
287 fn retired_events_are_not_offered() {
288 for kind in RETIRED_EVENT_TYPES {
289 assert!(!EVENT_TYPES.contains(&kind), "{kind}");
290 }
291 }
Fixes from the page sweep292
293 /// The TypeScript mirror lists the same events, in the same order.
294 #[test]
295 fn the_typescript_mirror_lists_the_same_events() {
296 let ts = include_str!("../../../packages/contracts/src/webhooks.ts");
297 let list = ts
298 .split_once("export const EVENT_TYPES = [")
299 .and_then(|(_, rest)| rest.split_once("] as const"))
300 .map(|(list, _)| list)
301 .expect("EVENT_TYPES in webhooks.ts");
302 let mirrored: Vec<&str> = list
303 .split(',')
304 .map(|item| item.trim().trim_matches('"'))
305 .filter(|item| !item.is_empty())
306 .collect();
307 assert_eq!(mirrored, EVENT_TYPES);
308 }
309}

This file's history is long; its oldest lines are credited to the oldest commit read.