Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| The statement is a month at a time, a line per kind of charge | 1 | import type { User, Viewer } from "./identity"; |
| 2 | import type { RepoPath } from "./repos"; | |
| 3 | import type { Result } from "./result"; | |
| 4 | ||
| 5 | /** | |
| 6 | * Events, delivered to the addresses a repository or a workspace registers. | |
| 7 | * Mirrors `crates/contracts/src/webhooks.rs`. | |
| 8 | */ | |
| 9 | ||
| 10 | /** Every event a webhook can be sent, in the order people are shown them. */ | |
| 11 | export const EVENT_TYPES = [ | |
| 12 | "git.push", | |
| Merge branch 'claude/cool-newton-7nm8r9' (#36): real GitHub Actions on g1t, managed deploy workflows, g1t/deploy and the Sysbox runner 0.2.0. The merge keeps both sides' webhook events and API operations, says agent images need tar, guards the job engine's stop to Unix so the runner builds on Windows again, and keeps the moves tests' previews from going idle as the calendar passes their fixture's date. | 13 | "git.deleted", |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 14 | "branch.renamed", |
| The statement is a month at a time, a line per kind of charge | 15 | "repo.created", |
| 16 | "repo.forked", | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 17 | "repo.updated", |
| 18 | "repo.visibility_changed", | |
| 19 | "repo.renamed", | |
| 20 | "repo.transferred", | |
| 21 | "repo.default_branch_changed", | |
| 22 | "repo.archived", | |
| 23 | "repo.unarchived", | |
| 24 | "repo.deleted", | |
| 25 | "repo.restored", | |
| 26 | "repo.purged", | |
| 27 | "repo.collaborator_added", | |
| 28 | "repo.collaborator_removed", | |
| 29 | "repo.collaborator_role_changed", | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 30 | "team.created", |
| 31 | "team.edited", | |
| 32 | "team.deleted", | |
| 33 | "team.member_added", | |
| 34 | "team.member_role_changed", | |
| 35 | "team.member_removed", | |
| 36 | "team.repo_added", | |
| 37 | "team.repo_role_changed", | |
| 38 | "team.repo_removed", | |
| @g1t welcomes you when you join a workspace, and that is the one introduction any agent makes. Identity now says when a person becomes a member, workspace.member_joined, by invitation, by an invite code, or by creating the workspace, and webhooks can hear it; the agents service hears it too, and for anyone who joined, never the creator, the workspace's @g1t opens your direct message and says in its own voice who it is, what to ask it, how agents answer, and where things are, once per person per workspace and charged to @g1t like any reply, with a fixed welcome when no model can be used. The agents, workspaces, authentication and webhooks guides say so. | 39 | "workspace.member_joined", |
| Merge rulesets: branch and tag rules, agent-first, enforced on push and merge | 40 | "ruleset.created", |
| 41 | "ruleset.updated", | |
| 42 | "ruleset.deleted", | |
| The statement is a month at a time, a line per kind of charge | 43 | "issue.opened", |
| 44 | "issue.updated", | |
| 45 | "issue.assigned", | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 46 | "issue.labeled", |
| 47 | "issue.unlabeled", | |
| 48 | "issue.milestoned", | |
| 49 | "issue.demilestoned", | |
| The statement is a month at a time, a line per kind of charge | 50 | "issue.closed", |
| 51 | "issue.reopened", | |
| 52 | "comment.created", | |
| Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts | 53 | "comment.edited", |
| 54 | "comment.deleted", | |
| The statement is a month at a time, a line per kind of charge | 55 | "pull.opened", |
| 56 | "pull.ready", | |
| 57 | "pull.updated", | |
| 58 | "pull.merge_requested", | |
| 59 | "pull.merged", | |
| 60 | "pull.closed", | |
| Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts | 61 | "pull.reopened", |
| 62 | "pull.converted_to_draft", | |
| Events: review requests, assignments, stops and deployments are published | 63 | "pull.assigned", |
| 64 | "pull.review_requested", | |
| 65 | "pull.review_request_removed", | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 66 | "pull.labeled", |
| 67 | "pull.unlabeled", | |
| 68 | "pull.milestoned", | |
| 69 | "pull.demilestoned", | |
| 70 | "pull.base_changed", | |
| Events: review requests, assignments, stops and deployments are published | 71 | "pull.stalled", |
| 72 | "pull.resumed", | |
| Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts | 73 | "release.created", |
| 74 | "release.published", | |
| 75 | "release.released", | |
| 76 | "release.prereleased", | |
| 77 | "release.edited", | |
| 78 | "release.unpublished", | |
| 79 | "release.deleted", | |
| The statement is a month at a time, a line per kind of charge | 80 | "agent.asked", |
| 81 | "checks.completed", | |
| Merge checks: statuses and check runs on every commit | 82 | "status.created", |
| 83 | "check_run.created", | |
| 84 | "check_run.completed", | |
| 85 | "check_run.rerequested", | |
| 86 | "check_run.requested_action", | |
| 87 | "check_suite.completed", | |
| 88 | "check_suite.rerequested", | |
| The statement is a month at a time, a line per kind of charge | 89 | "review.completed", |
| 90 | "workflow.completed", | |
| Events: review requests, assignments, stops and deployments are published | 91 | "deployment.succeeded", |
| 92 | "deployment.failed", | |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 93 | "deployment.created", |
| 94 | "deployment_status.created", | |
| The statement is a month at a time, a line per kind of charge | 95 | "queue.changed", |
| 96 | "session.appended", | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 97 | "package.published", |
| 98 | "package.version_deleted", | |
| 99 | "package.deleted", | |
| 100 | "package.visibility_changed", | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 101 | "secret_scanning_alert.created", |
| 102 | "secret_scanning_alert.fixed", | |
| 103 | "secret_scanning_alert.dismissed", | |
| 104 | "secret_scanning_alert.reopened", | |
| 105 | "secret_scanning.bypass_requested", | |
| 106 | "secret_scanning.bypass_reviewed", | |
| 107 | "code_scanning_alert.created", | |
| 108 | "code_scanning_alert.fixed", | |
| 109 | "code_scanning_alert.dismissed", | |
| 110 | "code_scanning_alert.reopened", | |
| 111 | "vulnerability_alert.created", | |
| 112 | "vulnerability_alert.fixed", | |
| 113 | "vulnerability_alert.dismissed", | |
| Security tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples. | 114 | "secret_scanning_alert.summary", |
| 115 | "code_scanning_alert.summary", | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 116 | "vulnerability_alert.reopened", |
| Security tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples. | 117 | "vulnerability_alert.summary", |
| 118 | "security_advisory.published", | |
| 119 | "security_advisory.withdrawn", | |
| 120 | "security_advisory.reported", | |
| Merge branch 'mirroring' into artifacts-mode | 121 | "mirror.unreachable", |
| 122 | "mirror.reachable", | |
| 123 | "mirror.state_changed", | |
| 124 | "mirror.moved_in", | |
| The statement is a month at a time, a line per kind of charge | 125 | ] as const; |
| 126 | ||
| 127 | export type Hook = { | |
| 128 | id: string; | |
| 129 | scope: "repo" | "workspace"; | |
| 130 | workspace: string; | |
| 131 | /** For a repository's webhook: `owner/name`. */ | |
| 132 | repo: string | null; | |
| 133 | url: string; | |
| 134 | /** Event types, or `["*"]` for all. */ | |
| 135 | events: string[]; | |
| 136 | active: boolean; | |
| 137 | secretHint: string; | |
| 138 | createdBy: string; | |
| 139 | createdAt: string; | |
| 140 | lastStatus: "delivered" | "pending" | "failed" | null; | |
| 141 | lastDeliveredAt: string | null; | |
| 142 | }; | |
| 143 | ||
| 144 | export type HookDelivery = { | |
| 145 | id: string; | |
| 146 | hookId: string; | |
| 147 | eventId: string; | |
| 148 | event: string; | |
| 149 | status: "pending" | "delivered" | "failed"; | |
| 150 | attempts: number; | |
| 151 | responseStatus: number | null; | |
| 152 | responseBody: string | null; | |
| 153 | error: string | null; | |
| 154 | durationMs: number | null; | |
| 155 | /** The JSON that was sent. */ | |
| 156 | payload: string; | |
| 157 | createdAt: string; | |
| 158 | deliveredAt: string | null; | |
| 159 | nextAttemptAt: string | null; | |
| 160 | }; | |
| 161 | ||
| 162 | /** A repository's webhooks, or with `repo` left out, the workspace's own. */ | |
| 163 | export type HookOwner = { workspace: string; repo?: RepoPath }; | |
| 164 | ||
| 165 | export interface WebhooksApi { | |
| 166 | list(viewer: Viewer, owner: HookOwner): Promise<Result<Hook[]>>; | |
| 167 | create( | |
| 168 | actor: User, | |
| 169 | owner: HookOwner, | |
| 170 | input: { url: string; events?: string[]; secret?: string }, | |
| 171 | ): Promise<Result<{ hook: Hook; secret: string | null }>>; | |
| 172 | update(actor: User, owner: HookOwner, id: string, input: { url?: string; events?: string[]; active?: boolean }): Promise<Result<Hook>>; | |
| 173 | delete(actor: User, owner: HookOwner, id: string): Promise<Result<boolean>>; | |
| 174 | ping(actor: User, owner: HookOwner, id: string): Promise<Result<HookDelivery>>; | |
| 175 | deliveries(viewer: Viewer, owner: HookOwner, id: string): Promise<Result<HookDelivery[]>>; | |
| 176 | redeliver(actor: User, owner: HookOwner, deliveryId: string): Promise<Result<HookDelivery>>; | |
| 177 | } |
This file's history is long; its oldest lines are credited to the oldest commit read.