steid

steid/migrations/20260906120301_create_webhooks.sql

1	-- Webhooks: where to POST when a repository receives a push.
2	--
3	-- The secret is stored in the clear, unlike a personal access token's. It has to
4	-- be: the delivery signature is an HMAC computed over each body, and a hash cannot
5	-- produce one. It is shown to its owner exactly once all the same, so it does not sit
6	-- on a page to be read over a shoulder, and what it protects is the receiver's trust in
7	-- Steid rather than anyone's access to Steid.
8	--
9	-- Belongs to a repository rather than to the user who added it: it is the repository's
10	-- pushes it reacts to, and it should outlive that person changing role.
11	create table webhooks (
12	id text primary key,
13	repo_id text not null references repositories (id) on delete cascade,
14	url text not null,
15	secret text not null,
16	-- A hook that is off is kept rather than deleted, so the delivery history that
17	-- explains why it was turned off stays readable.
18	active integer not null default 1,
19	created_at integer not null
20	);
21
22	create index webhooks_repo_id on webhooks (repo_id, created_at asc);