[ppXD]

Summary

• Who may start a run.
  • PR trigger payloads now carry authorAssociation, isFork and headRepositoryFullName. For GitLab, the author's project access level is looked up once per delivery; Developer and above counts as a member.
  • trigger.pr.opened and trigger.pr.updated gain an authors filter (any | members). Under members, new commits on a fork head must also be pushed by the author or by a member. Otherwise a member's PR opened from an outsider's fork would run the outsider's later pushes. GitLab's pusher is looked up; GitHub's cannot be, so another user's push to a fork head is refused.
  • An activation with no authors value (every existing one) admits only members when the delivery says the repository is public or internal, anyone when it says private, and only members for a fork PR when it doesn't say.
• How often. Opened, reopened and synchronize events start one run per (activation, PR, head commit) within 60 s. A close/reopen loop collapses into one run, and a member's follow-up push always gets its own run. A delivery that already started its run is skipped before admission. Posting it again (Redeliver, or a captured body with its own id) cannot restart that window (RunSourceDispatcher.FireIfMatchesAsync).
• Replay and audit.
  • GitHub deliveries without X-GitHub-Delivery are refused with 400.
  • A signed body is claimed per hook for 7 days, so the same body under a different delivery id starts nothing.
  • Refusals anyone can cause collapse to one row per hook and reason per day, with headers capped.
• Size and rate.
  • Webhook bodies are capped at 25 MiB and callback bodies at 1 MiB, and the hook is resolved before its body is read.
  • Each remote address gets 10,000 ingress requests a minute, checked first as the app's GlobalLimiter. After that, 2,000 per (hook or token, address). The per-target key is chosen by the sender, so a sender rotating it used to get a new limiter on every request and was never limited.
  • The callback route accepts only the engine's 32-character token ({token:length(32)}).
• Claims. Claims live in webhook_claim (migration 0244) and are taken in the delivery's transaction. Expired rows are deleted by WebhookClaimPurgeRecurringJob every 5 minutes, using SKIP LOCKED, in batches that each commit on their own. Before this, each delivery purged expired rows inside its own transaction, and two deliveries could deadlock (40P01).

Test plan

• Unit: full suite, 12,923 passed. Includes the authors default and the pusher rule, the GitHub and GitLab pusher and head-SHA readers, the debounce key, the purge job and handler, and the recurring-job and authorization inventories.
• Integration (Postgres):
  • admission flows: internal default, pusher (GitHub, and GitLab via a stub host), per-head debounce, a delivery posted again after the window;
  • claim store: concurrent claimants among 150 expired keys no longer deadlock, and the sweep steps around a row a delivery holds (a mutation without SKIP LOCKED goes red);
  • ingress contract pins and the sweep-command census.
• E2E (real app host):
  • one source changing the target on every request gets 429 once its address budget is spent;
  • 8000-character callback tokens never reach the limiter and leave nothing behind;
  • a token the engine actually minted resumes its run over HTTP;
  • a member's second push within a minute runs;
  • an outsider's push to a member's fork PR on a public repository starts nothing;
  • the internal-repository default;
  • every registered recurring job, including the new sweep, completes a tick on a real Hangfire worker.
• Frontend: pnpm lint, tsc --noEmit -p tsconfig.app.json, vitest (2,366 passed), pnpm build.
• Staging: watch the author_not_member and pull_request_debounced refusal rates on public and internal repositories, and 429s on /api/webhooks/* behind the production proxy.