From 9f42a2267a4735f32fe06b5cdb2f187d7141ac64 Mon Sep 17 00:00:00 2001 From: defangdevs Date: Fri, 23 Oct 2026 20:52:50 +0000 Subject: [PATCH 1/3] chore(webhook): bump local-webhook pin 0.32.0 -> 0.34.0 0.34.0 keys the dispatch bucket on the object an event is about (issue/PR number, CI sha, generic identifier), so a coalesced batch never holds two objects and the single spawn meta is complete (#887). Skips no release, but note 0.33.0 rides along: the durable on-disk inbox for accepted deliveries. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01RWWyHRhpJYRa9fKq1Qnpwi --- modules/agent-box.nix | 4 ++-- nix/webhook-pin.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/agent-box.nix b/modules/agent-box.nix index 3365d12c..a9d26ad3 100644 --- a/modules/agent-box.nix +++ b/modules/agent-box.nix @@ -1637,8 +1637,8 @@ let # module-generated-up-to-date check fails until it matches. { repo = "defangdevs/local-channels"; - rev = "2be2185cbc196aaaa88cef1d9da0292d94ba7243"; - sha256 = "sha256-N95IhtnjXXqt5WB5wq0pISAsXwxmAFLI/zafl/J4aPU="; + rev = "257822e96674920fd2aff5ac0b52811a18854e69"; + sha256 = "sha256-aeCeLNwY0/jcgbWre551O/QRnHGtktUhqF+urYXi6I8="; } ; localWebhookScript = builtins.fetchurl { diff --git a/nix/webhook-pin.nix b/nix/webhook-pin.nix index 33a0be34..deb1a835 100644 --- a/nix/webhook-pin.nix +++ b/nix/webhook-pin.nix @@ -16,6 +16,6 @@ # module-generated-up-to-date check fails until it matches. { repo = "defangdevs/local-channels"; - rev = "2be2185cbc196aaaa88cef1d9da0292d94ba7243"; - sha256 = "sha256-N95IhtnjXXqt5WB5wq0pISAsXwxmAFLI/zafl/J4aPU="; + rev = "257822e96674920fd2aff5ac0b52811a18854e69"; + sha256 = "sha256-aeCeLNwY0/jcgbWre551O/QRnHGtktUhqF+urYXi6I8="; } From aa9bc1db9247d6681b7494178a84c4d5a2133af0 Mon Sep 17 00:00:00 2001 From: defangdevs Date: Fri, 23 Oct 2026 21:07:59 +0000 Subject: [PATCH 2/3] tests(webhook): give each re-processed delivery its own id 0.33.0's durable inbox drops a re-sent delivery id as a duplicate before dispatch, so the dispatch-brake post (the third send of test-1) never reached the dispatcher and the "not spawning" log line the test waits for never came. Re-sends that must be processed again now carry a fresh id; the signature covers the body only, so nothing else changes. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01RWWyHRhpJYRa9fKq1Qnpwi --- tests/webhook.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tests/webhook.nix b/tests/webhook.nix index f9ce7788..60bc0524 100644 --- a/tests/webhook.nix +++ b/tests/webhook.nix @@ -526,6 +526,10 @@ " -H 'content-type: application/json' -H 'x-github-event: workflow_run'" " -H 'x-github-delivery: test-1' --data-binary @/tmp/body.json" ) + # 0.33.0 drops a re-sent delivery id, so a later post that must be + # processed again needs an id of its own. + ids = iter(range(100)) + fresh = lambda: post.replace("test-1", "test-1-%d" % next(ids)) # noqa: E731 # Wrong signature and no signature are both refused, before any parsing. client.succeed( f"{post} -H 'x-hub-signature-256: sha256=00' " @@ -617,7 +621,7 @@ # sessions on one PR. The suppression is logged, because a silently skipped # spawn is indistinguishable from a watch that stopped working (#170). client.succeed( - f"{post} -H 'x-hub-signature-256: sha256={sig}' " + f"{fresh()} -H 'x-hub-signature-256: sha256={sig}' " f"https://box.test/agent/webhook/github | grep -x 200" ) machine.wait_until_succeeds( @@ -693,7 +697,7 @@ # restarting it afterwards proves the spawn + consumption half. machine.succeed("systemctl stop agent-box@agent.service") client.succeed( - f"{post} -H 'x-hub-signature-256: sha256={sig}' " + f"{fresh()} -H 'x-hub-signature-256: sha256={sig}' " f"https://box.test/agent/webhook/github | grep -x 200" ) machine.wait_until_succeeds( @@ -865,7 +869,7 @@ timeout=30, ) client.succeed( - f"{post} -H 'x-hub-signature-256: sha256={sig}' " + f"{fresh()} -H 'x-hub-signature-256: sha256={sig}' " f"https://box.test/agent/webhook/github | grep -x 200" ) # The named suppression is the primary evidence: had the brake missed, the From 0d1a9c546e1b1df2be383017d4841694ce9311c1 Mon Sep 17 00:00:00 2001 From: defangdevs Date: Fri, 23 Oct 2026 21:30:30 +0000 Subject: [PATCH 3/3] chore(webhook): pin local-webhook 0.34.1 0.34.1 adds the event's source, the matching watch's topic and its name to the dispatch bucket (local-channels#104), closing the review findings on this PR: one object id from two senders, or under two watches, never shares a batch. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01RWWyHRhpJYRa9fKq1Qnpwi --- modules/agent-box.nix | 4 ++-- nix/webhook-pin.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/agent-box.nix b/modules/agent-box.nix index a9d26ad3..ba4d8526 100644 --- a/modules/agent-box.nix +++ b/modules/agent-box.nix @@ -1637,8 +1637,8 @@ let # module-generated-up-to-date check fails until it matches. { repo = "defangdevs/local-channels"; - rev = "257822e96674920fd2aff5ac0b52811a18854e69"; - sha256 = "sha256-aeCeLNwY0/jcgbWre551O/QRnHGtktUhqF+urYXi6I8="; + rev = "17c457ac57258c5a8b96c667eedaec95ad8c35e8"; + sha256 = "sha256-JH5ouvviN2UWRS89bGn1aUXUIwtUAQ6uPo1xX8nQCD8="; } ; localWebhookScript = builtins.fetchurl { diff --git a/nix/webhook-pin.nix b/nix/webhook-pin.nix index deb1a835..e97c9da4 100644 --- a/nix/webhook-pin.nix +++ b/nix/webhook-pin.nix @@ -16,6 +16,6 @@ # module-generated-up-to-date check fails until it matches. { repo = "defangdevs/local-channels"; - rev = "257822e96674920fd2aff5ac0b52811a18854e69"; - sha256 = "sha256-aeCeLNwY0/jcgbWre551O/QRnHGtktUhqF+urYXi6I8="; + rev = "17c457ac57258c5a8b96c667eedaec95ad8c35e8"; + sha256 = "sha256-JH5ouvviN2UWRS89bGn1aUXUIwtUAQ6uPo1xX8nQCD8="; }