diff --git a/app/main.py b/app/main.py index 28cf73b..953d251 100755 --- a/app/main.py +++ b/app/main.py @@ -31,6 +31,11 @@ CORE_SERVICES = { "appfactory-worker", } +IGNORED_REPOSITORIES = { + "appfactory-tools", + "appfactory-infrastructure", +} + app = FastAPI(title="AppFactory Webhook") @@ -57,6 +62,7 @@ def verify_signature(body: bytes, signature: str | None): def first_commit(payload: dict) -> dict: commits = payload.get("commits") or [] + if commits: return commits[-1] or {} @@ -105,6 +111,43 @@ def extract_attribution(payload: dict) -> dict: } +def audit_event( + username: str, + action: str, + target_type: str, + target_id: str, + source: str, + metadata: dict, +): + con = sqlite3.connect(DB_FILE) + + con.execute( + """ + INSERT INTO audit_events ( + username, + action, + target_type, + target_id, + source, + metadata, + created_at + ) + VALUES (?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP) + """, + ( + username, + action, + target_type, + target_id, + source, + json.dumps(metadata, ensure_ascii=False), + ), + ) + + con.commit() + con.close() + + def create_job( job_type: str, target_type: str, @@ -142,37 +185,6 @@ def create_job( ) job_id = cur.lastrowid - - con.execute( - """ - INSERT INTO audit_events ( - username, - action, - target_type, - target_id, - source, - metadata, - created_at - ) - VALUES (?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP) - """, - ( - created_by_username, - "webhook.deploy.queued", - target_type, - target_id, - "webhook", - json.dumps( - { - "job_id": job_id, - "job_type": job_type, - **payload, - }, - ensure_ascii=False, - ), - ), - ) - con.commit() con.close() @@ -198,6 +210,31 @@ async def gitea_webhook( raise HTTPException(status_code=400, detail="Missing repository name") attr = extract_attribution(payload) + ref = payload.get("ref") or "" + + metadata = { + "repository": repo_name, + "ref": ref, + "commit_sha": attr["commit_sha"], + "commit_author": attr["commit_author"], + "pusher": attr["pusher"], + } + + if repo_name in IGNORED_REPOSITORIES: + audit_event( + username=attr["pusher_username"], + action="webhook.deploy.ignored", + target_type="repository", + target_id=repo_name, + source="webhook", + metadata=metadata, + ) + + return { + "status": "ignored", + "repo": repo_name, + "reason": "repository is not deployable", + } if repo_name in CORE_SERVICES: job_type = "deploy_core_service" @@ -206,25 +243,29 @@ async def gitea_webhook( job_type = "deploy_app" target_type = "app" - ref = payload.get("ref") or "" - job_payload = { - "repository": repo_name, - "ref": ref, - "commit_sha": attr["commit_sha"], - "commit_author": attr["commit_author"], - "pusher": attr["pusher"], - } - job_id = create_job( job_type=job_type, target_type=target_type, target_id=repo_name, - payload=job_payload, + payload=metadata, created_by_username=attr["pusher_username"], created_by_display_name=attr["pusher"], source="webhook", ) + audit_event( + username=attr["pusher_username"], + action="webhook.deploy.queued", + target_type=target_type, + target_id=repo_name, + source="webhook", + metadata={ + "job_id": job_id, + "job_type": job_type, + **metadata, + }, + ) + return { "status": "queued", "job_id": job_id,