Ignore non-deployable repositories in webhook

app/main.py

@@ -31,6 +31,11 @@ CORE_SERVICES = {
     "appfactory-worker",
 }
 
+IGNORED_REPOSITORIES = {
+    "appfactory-tools",
+    "appfactory-infrastructure",
+}
+
 app = FastAPI(title="AppFactory Webhook")
 
 
@@ -57,6 +62,7 @@ def verify_signature(body: bytes, signature: str | None):
 
 def first_commit(payload: dict) -> dict:
     commits = payload.get("commits") or []
+
     if commits:
         return commits[-1] or {}
 
@@ -105,6 +111,43 @@ def extract_attribution(payload: dict) -> dict:
     }
 
 
+def audit_event(
+    username: str,
+    action: str,
+    target_type: str,
+    target_id: str,
+    source: str,
+    metadata: dict,
+):
+    con = sqlite3.connect(DB_FILE)
+
+    con.execute(
+        """
+        INSERT INTO audit_events (
+            username,
+            action,
+            target_type,
+            target_id,
+            source,
+            metadata,
+            created_at
+        )
+        VALUES (?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
+        """,
+        (
+            username,
+            action,
+            target_type,
+            target_id,
+            source,
+            json.dumps(metadata, ensure_ascii=False),
+        ),
+    )
+
+    con.commit()
+    con.close()
+
+
 def create_job(
     job_type: str,
     target_type: str,
@@ -142,37 +185,6 @@ def create_job(
     )
 
     job_id = cur.lastrowid
-
-    con.execute(
-        """
-        INSERT INTO audit_events (
-            username,
-            action,
-            target_type,
-            target_id,
-            source,
-            metadata,
-            created_at
-        )
-        VALUES (?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
-        """,
-        (
-            created_by_username,
-            "webhook.deploy.queued",
-            target_type,
-            target_id,
-            "webhook",
-            json.dumps(
-                {
-                    "job_id": job_id,
-                    "job_type": job_type,
-                    **payload,
-                },
-                ensure_ascii=False,
-            ),
-        ),
-    )
-
     con.commit()
     con.close()
 
@@ -198,6 +210,31 @@ async def gitea_webhook(
         raise HTTPException(status_code=400, detail="Missing repository name")
 
     attr = extract_attribution(payload)
+    ref = payload.get("ref") or ""
+
+    metadata = {
+        "repository": repo_name,
+        "ref": ref,
+        "commit_sha": attr["commit_sha"],
+        "commit_author": attr["commit_author"],
+        "pusher": attr["pusher"],
+    }
+
+    if repo_name in IGNORED_REPOSITORIES:
+        audit_event(
+            username=attr["pusher_username"],
+            action="webhook.deploy.ignored",
+            target_type="repository",
+            target_id=repo_name,
+            source="webhook",
+            metadata=metadata,
+        )
+
+        return {
+            "status": "ignored",
+            "repo": repo_name,
+            "reason": "repository is not deployable",
+        }
 
     if repo_name in CORE_SERVICES:
         job_type = "deploy_core_service"
@@ -206,25 +243,29 @@ async def gitea_webhook(
         job_type = "deploy_app"
         target_type = "app"
 
-    ref = payload.get("ref") or ""
-    job_payload = {
-        "repository": repo_name,
-        "ref": ref,
-        "commit_sha": attr["commit_sha"],
-        "commit_author": attr["commit_author"],
-        "pusher": attr["pusher"],
-    }
-
     job_id = create_job(
         job_type=job_type,
         target_type=target_type,
         target_id=repo_name,
-        payload=job_payload,
+        payload=metadata,
         created_by_username=attr["pusher_username"],
         created_by_display_name=attr["pusher"],
         source="webhook",
     )
 
+    audit_event(
+        username=attr["pusher_username"],
+        action="webhook.deploy.queued",
+        target_type=target_type,
+        target_id=repo_name,
+        source="webhook",
+        metadata={
+            "job_id": job_id,
+            "job_type": job_type,
+            **metadata,
+        },
+    )
+
     return {
         "status": "queued",
         "job_id": job_id,