feat: isolate socket-activated webhook ingress

[giscebot]

Summary

• split public webhook reception into a minimal FastAPI ingress process
• add a systemd-owned TCP socket with backlog, passing fd 3 to Uvicorn
• route only POST /api/webhooks/github to the ingress while dashboard/OAuth remain on the dashboard service
• preserve the existing dashboard webhook route for backward compatibility
• classify dashboard-only, webhook-only and shared API updates independently
• expose webhook service/socket health in the System view and document installation/operation

Availability model

The listening socket remains open while the ingress process restarts. New connections wait in the kernel backlog instead of receiving connection refused. Dashboard and frontend restarts do not touch webhook ingress.

Validation

• pytest -q — 404 passed
• npm test -- --run — 62 passed
• npm run build
• inherited TCP socket smoke test — /api/health returned successfully through Uvicorn --fd
• systemd-analyze --user verify parsed the units; its only warning was the expected not-yet-installed console entrypoint

Refs #191

Requested by: @ecarreras

[pilipilisbot]

Thanks, the ingress split itself is directionally sound and the PR already covers the important parts: minimal FastAPI ingress, socket activation, nginx routing, autoupdate/service-status awareness, and focused webhook/systemd tests. I checked the PR metadata/diff, AGENTS.md, the webhook/backend/autoupdate/systemd changes, git diff --check, git merge-tree against current origin/main, and GitHub checks. CI is green on the PR head (pytest 3.11/3.12 and dashboard).

Blocking issue: this PR is not mergeable against current main. GitHub reports mergeStateStatus=DIRTY, and a local merge-tree shows real conflicts, at least in CHANGELOG.md, dashboard/src/main.tsx, and dashboard/src/main.test.tsx. The dashboard conflicts are not just release-changelog noise; they overlap with already-merged webhook delivery detail/update-badge work, so this needs a rebase/merge adaptation before I can approve the final integration.

Local note: I could not run pytest in the worktree because the local Python environment has no pytest installed, so I relied on the passing GitHub checks plus static/diff review. Once rebased on current main, rerun the existing CI set (pytest -q, dashboard tests/build) and I can re-review the resolved diff.

[ecarreras]

@giscebot revisa els canvis demanats

[giscebot]

He tornat a comprovar la PR contra el main actual. No hi ha canvis nous per reavaluar: el head continua sent 33438387, el mateix commit que ja tenia la revisió amb canvis demanats.

El bloqueig continua vigent i ara git merge-tree origin/main HEAD detecta conflictes en:

• dashboard/src/main.tsx
• docs/ingestion.md
• src/github_agent_bridge/backend.py
• src/github_agent_bridge/dashboard_static/index.html
• src/github_agent_bridge/queue.py
• src/github_agent_bridge/webhook.py
• systemd/env.example
• tests/test_webhook.py

Els checks verds corresponen al mateix head sense integrar amb el main actual, així que no validen la resolució. Cal actualitzar la branca amb main, resoldre aquests solapaments i tornar a executar CI; després sí que té sentit demanar una nova revisió.

[pilipilisbot]

He revisat de nou la PR contra el origin/main actual després de fer fetch. El head continua sent 33438387, GitHub marca mergeStateStatus=DIRTY / mergeable=false, i git merge-tree origin/main HEAD confirma conflictes reals en punts centrals de la PR:

• dashboard/src/main.tsx
• docs/ingestion.md
• src/github_agent_bridge/backend.py
• src/github_agent_bridge/dashboard_static/index.html
• src/github_agent_bridge/queue.py
• src/github_agent_bridge/webhook.py
• systemd/env.example
• tests/test_webhook.py

Això continua sent bloquejant: els conflictes afecten l'ingrés webhook, la cua/esquema i tests, no només artefactes generats o documentació. Els checks verds del PR head són útils, però encara no validen la resolució contra el main actual.

També he mirat el diff rellevant de backend/webhook/autoupdate/systemd/tests i he passat git diff --check origin/main...HEAD sense incidències. No he pogut executar tests locals perquè aquest entorn no té pytest instal·lat (python3 -m pytest ... falla amb No module named pytest).

Cal actualitzar la branca amb main, resoldre aquests conflictes i tornar a executar la suite abans d'aprovar.

[pilipilisbot]

Reviewed the updated head 4fcabedbed4646cccae2d4839b2d0bd5a5f08976 after the rebase/conflict resolution. The PR is now cleanly mergeable against current main, and GitHub checks are green for dashboard, pytest (3.11), and pytest (3.12).

I re-checked the resolved diff around the dedicated FastAPI webhook ingress, socket-activated systemd units, nginx routing, autoupdate classification/restart planning, systemd status exposure, and the new/focused webhook tests. The dashboard keeps the legacy webhook route while production can route the exact delivery path to the minimal ingress, and the service split no longer conflicts with the already-merged webhook/dashboard work.

Local note: this host still has no system pytest, so I could not rerun the Python suite locally. I did run static merge/whitespace checks and systemd-analyze --user verify on the touched units; verify only failed on the expected not-installed console script path for github-agent-bridge-webhook, not on unit syntax.

No blocking findings from my side.

[giscebot]

Verificació post-merge completada sobre el commit 8a96694 a main. El workflow de push ha acabat en verd (dashboard, pytest 3.11 i pytest 3.12), i també han passat release i dependency graph. El bloqueig anterior d’integració amb main havia quedat resolt abans del merge i no queden fils de review oberts. No cal cap acció addicional per aquesta PR.