Turtle
e7def469e1
* feat(i18n): key translation pairing records by heading section Replace the whole-file blob hashes in *.i18n.yaml with one entry per heading section that still holds language-specific content, keyed by the English heading-slug path. Blocks identical across the pair (generated table rows, code blocks, shared regions) stay out of the hash, so edits to different sections and identical regenerations merge with Git's default text merge, including on GitHub. Remove the dsh-translation-pairing merge driver, its resolver command and installer wiring; gen-translation-brief recovers last-confirmed text from commit history. Migrate all active records, archive the superseded Agent Note, and record the replayed conflict reduction in the new one. * test(i18n): refresh translation prompt snapshot for the terminology note * feat(i18n): exclude only code blocks and generated regions from pairing records Replace byte-equality masking with an explicit rule: a record hash skips fenced code blocks and BEGIN/END GENERATED regions, the two kinds of content the pairing gate already requires to be identical on both sides. Move generated data into regions written into both pages: gen-config-catalog renders both languages and the record with per-package regions labelled by code identifiers; gen-module-graph keeps its table in a region; gen-doc-graphs splices the event matrix regions into the Chinese page. Add a generic region splice beside the region grammar.
description, kind
| description | kind |
|---|---|
| Signed GitHub webhook adapter for deployments routing authenticated JSON events into the webhook runtime. | package-reference |
@deepseek-ai/dsh-webhook-github
English | 中文
Summary
dsh-webhook-github registers one exact HTTP route on the injected ctx.webServer. It bounds and verifies GitHub's raw JSON body, projects a provider-neutral delivery, calls ctx.webhookRuntime.dispatch(), and returns 202 without waiting for rules or Sessions. Use it when a deployment needs authenticated GitHub ingress for the generic webhook runtime.
Table of Contents
- Configuration
- HTTP contract
- Dedicated listener composition
- Model Experience
- Known Limitations and Deferred Work
- Dev Note
Configuration
| Key | Meaning |
|---|---|
source |
Non-empty adapter instance carried to rules, such as primary-github. |
path |
Exact non-root pathname without trailing slash, query, or fragment. |
secretEnv |
Credential reference containing the GitHub webhook secret. |
maxBodyBytes |
Positive safe-integer ceiling for the untouched request body. |
All fields are required. The secret reference is resolved for every request, so rotation affects the next delivery without reloading the plugin.
HTTP contract
Only POST application/json is accepted. The adapter reads a bounded UTF-8 body, requires X-Hub-Signature-256, X-GitHub-Delivery, and X-GitHub-Event, resolves the secret, verifies HMAC before JSON parsing, and requires a top-level lossless-JSON object. It never logs the secret, signature, or payload.
| Status | Meaning |
|---|---|
202 |
Verified JSON was dispatched in memory. |
400 |
Required header, UTF-8, JSON, or top-level object was invalid. |
401 |
Signature was invalid. |
405 |
Method was not POST. |
413 |
Declared or streamed body exceeded maxBodyBytes. |
415 |
Media type was not application/json. |
503 |
Credential or webhook runtime was unavailable. |
202 does not state that any rule matched or that a Session was created. GitHub event-specific field validation belongs to each rule; the adapter guarantees only authenticated generic JSON.
Dedicated listener composition
The normal Web profile already owns ctx.webServer. Mount another dsh-host-webserver and this adapter inside a group that isolates only webServer; the adapter still inherits credentials and webhookRuntime. The GitHub review guide uses 127.0.0.1:3081/github behind a TLS reverse proxy while the UI remains on port 3080.
Model Experience
Indirectly, through dsh-webhook: this adapter contributes no prompt or tool schema; a matching rule owns the Session request and model-visible text.
KV Cache effect
Independent. Authentication and HTTP dispatch do not touch a model request; any new Session prefix belongs to the consuming rule and runtime.
Known Limitations and Deferred Work
- No TLS — the injected development WebServer is normally loopback-only behind a TLS reverse proxy or tunnel.
- Generic payload validation only — rules own validation of the GitHub event fields they consume.
- No provider acknowledgement of downstream work —
202precedes arbitrary rule calls and Session creation. - No form encoding — GitHub must send
application/json;application/x-www-form-urlencodedis rejected.
Dev Note
Working context for maintainers — click to expand
None.
Runtime invariant: No companion is published. Authentication and input validation occur at the exact HTTP operation; dsh-host-webserver owns route/disposer symmetry.