feat: per-group webhook ingress, custom webhooks, GitHub App tenant isolation

Add POST /webhook/{groupId} with per-group secrets (KV tenant:{groupId}), a custom provider (X-WebHooker-Signature HMAC, arbitrary JSON -> custom events through the route pipeline), and GitHub App installation isolation (Group.installationId) with automatic provisioning on installation.created (inst-{id} groups or binding matching owners groups). Includes WebhookPanel admin UI, custom route template, docs and 157 passing tests.
This commit is contained in:
RhenCloud 2026-08-13 09:24:50 +08:00
parent 0b078d938b
commit b600f02027
No known key found for this signature in database
GPG key ID: A574A617378C4E0B
34 changed files with 1711 additions and 183 deletions

View file

@ -38,6 +38,7 @@ export interface Group {
members?: GroupMember[];
owners?: string[];
providers?: ("github" | "gitea" | "gitlab")[];
installationId?: number;
emoji?: boolean;
lang?: string;
logTarget?: RouteTarget;
@ -146,6 +147,11 @@ export const ROUTE_TEMPLATES: RouteTemplate[] = [
nameKey: "templates.commitComment",
filters: [{ type: "event", match: "commit_comment" }],
},
{
id: "custom-webhook",
nameKey: "templates.customWebhook",
filters: [{ type: "event", match: "custom" }],
},
];
export const FILTER_TYPES = ["event", "repo", "actor", "action", "branch", "keyword"] as const;