fix: acknowledge GitHub ping events on the git webhook route

[thegdsks]

Summary

• Found while live-testing webhook delivery on console.levelrail.com: connecting a repo via github-app use-as-source auto-registers a GitHub webhook, which immediately fires a "ping" event. That event has neither a push nor a release payload shape, so it fell through to the push parser and came back as "malformed payload" (400).
• Confirmed live: gh api repos/<owner>/<repo>/hooks showed last_response: {"code":400} for the hook right after creation, even though the very next real push delivered and deployed correctly (so this never blocked a real deploy, just made every new connection's first delivery look broken in GitHub's own UI and in apps webhook-deliveries list).
• Routes X-GitHub-Event: ping to a 200 ack before it reaches webhook.ParsePushEventForProvider, the same pattern already used for merge_group and release.

Test plan

• New regression test TestHandleGitPushWebhook_GitHubPing_Returns200, confirmed it fails on pre-fix code (400 "malformed payload") and passes after the fix
• go build ./..., go vet ./internal/api/... clean
• golangci-lint run ./internal/api/...: 0 issues
• go test ./internal/api/...: full package pass

Does not fix: GitLab/Bitbucket/Gitea have no equivalent "ping" event wired up because none of their webhook UIs show a scary status for one (out of scope here).

Summary by CodeRabbit

• Bug Fixes
  • GitHub ping webhook requests now receive a successful acknowledgment instead of being processed as push events. No deployment is triggered.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 10151940-31de-4fc2-8d73-68fac787d427

📥 Commits

Reviewing files that changed from the base of the PR and between 1d137c7 and 5b4d582.

📒 Files selected for processing (2)

• internal/api/git_webhook.go
• internal/api/git_webhook_test.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The webhook handler now recognizes GitHub ping events from the X-GitHub-Event header. It returns HTTP 200 with an acknowledgment and does not parse the payload as a push event. A regression test checks the response and confirms that the builder is not invoked.

Changes

GitHub ping webhook handling

Layer / File(s)	Summary
Recognize and acknowledge ping events internal/api/git_webhook.go, internal/api/git_webhook_test.go	The handler checks whether the event header is ping and returns HTTP 200 with an acknowledgment. The regression test verifies the response and confirms that the builder is not invoked.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 5b4d5

GitHub setup pings receive the intended acknowledgment without triggering a deployment. No merge-blocking risk is established by the supplied change context.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 5b4d5

The acknowledgment remains behind authentication and cannot trigger a deployment. No introduced security issue was established, but incomplete coverage and unknown ingress behavior limit confidence in a minimal-risk assessment.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated effect is limited to authenticated delivery classification, acknowledgment, and delivery history for the named git source. The new branch supplies no path to builder execution or deployment state.

Security Findings and Attack Paths

• inferred — Relabeling a valid signed push as ping would now acknowledge it without processing. This is not retained as an introduced attack capability: existing release dispatch already permits a successful no-processing response for non-release-triggered sources, and an attacker’s ability to alter authenticated delivery headers is not established.

Trust Boundaries and Controls

• observed — The ping shortcut does not bypass source lookup or authentication. Invalid authentication returns 401 before dispatch, oversized bodies are rejected, and the existing rate limiter executes before source lookup when configured.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: acknowledging GitHub ping events on the git webhook route.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}