ca27e3f214
Some checks failed
Smoke Test / smoke (pull_request) Failing after 23s
Architecture Lint / Linter Tests (pull_request) Successful in 27s
Validate Config / YAML Lint (pull_request) Failing after 18s
Validate Config / JSON Validate (pull_request) Successful in 20s
Validate Config / Python Syntax & Import Check (pull_request) Failing after 58s
Validate Config / Python Test Suite (pull_request) Has been skipped
Validate Config / Shell Script Lint (pull_request) Failing after 1m1s
Validate Config / Cron Syntax Check (pull_request) Successful in 10s
Validate Config / Deploy Script Dry Run (pull_request) Successful in 12s
Validate Config / Playbook Schema Validation (pull_request) Successful in 27s
Architecture Lint / Lint Repository (pull_request) Failing after 23s
PR Checklist / pr-checklist (pull_request) Successful in 3m4s
76 lines
1.7 KiB
YAML
76 lines
1.7 KiB
YAML
# Webhook Runner Configuration — GEMINI-HARDEN-04
|
|
# Placed alongside scripts/webhook_runner.py
|
|
# Environment variables override these values.
|
|
|
|
webhook:
|
|
# Network binding
|
|
host: 127.0.0.1
|
|
port: 7777
|
|
|
|
# Shared secret with Gitea (REQUIRED in production)
|
|
# Set via WEBHOOK_SECRET env var or replace here
|
|
secret: null
|
|
|
|
# Allowlists
|
|
allowed_events:
|
|
- push
|
|
- pull_request
|
|
- issues
|
|
- issue_comment
|
|
|
|
# Repository allowlist — patterns: "org/repo" or "org/*"
|
|
allowed_repos:
|
|
- "Timmy_Foundation/*"
|
|
|
|
# Branches allowed for push events (pattern match against full ref)
|
|
allowed_branches:
|
|
- main
|
|
- master
|
|
- develop
|
|
|
|
# PR/issue actions allowed
|
|
allowed_actions:
|
|
- opened
|
|
- closed
|
|
- synchronize
|
|
- reopened
|
|
- created
|
|
- edited
|
|
|
|
# Idempotency — prevents double-processing on retries
|
|
idempotency:
|
|
state_file: .webhook_idempotency.json
|
|
max_entries: 10000
|
|
ttl_days: 30
|
|
|
|
# Structured logging
|
|
logging:
|
|
level: INFO
|
|
file: null # null → stdout
|
|
|
|
# Safe dispatch rules — only pre-approved actions
|
|
dispatch:
|
|
push:
|
|
refs/heads/main:
|
|
allowed: true
|
|
action: log_and_ack
|
|
comment: Main push — logged, no auto-deploy
|
|
refs/heads/:
|
|
allowed: true
|
|
action: log_and_ack
|
|
comment: Non-main branch push — logged
|
|
pull_request:
|
|
opened:
|
|
allowed: true
|
|
action: log_and_ack
|
|
comment: PR opened — logged
|
|
synchronize:
|
|
allowed: true
|
|
action: log_and_ack
|
|
comment: PR updated — logged
|
|
issues:
|
|
opened:
|
|
allowed: true
|
|
action: log_and_ack
|
|
comment: Issue opened — logged
|