feat(github): publish webhook events to Event Bus

[JonasJesus42]

Summary

• Add EVENT_BUS binding to StateSchema with EVENT_BUS::* scope
• Publish webhook events to Event Bus after signature verification and installation mapping
• Rename app from github-mcp to mcp-github

Test plan

• Configure webhook on GitHub App pointing to /webhooks/github
• Trigger a push/PR event and verify it appears in Event Bus
• Verify other MCPs can subscribe to github.* events

🤖 Generated with Claude Code

---

Summary by cubic

Publishes verified GitHub webhook events to the Event Bus so other MCPs can consume github.* events. Renames the app to mcp-github.

• New Features

  • Publish via EVENT_BUS.EVENT_PUBLISH with type, subject, and full payload; cache the publisher on runtime onChange for use in the webhook path.
  • Add EVENT_BUS to the state schema and runtime scopes (EVENT_BUS::*).

• Migration

  • Grant EVENT_BUS::* scope and bind @deco/event-bus.
  • Ensure the GitHub App webhook points to /webhooks/github.

^{Written for commit 8d7bd5e. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="github/server/webhook.ts">

<violation number="1" location="github/server/webhook.ts:67">
P1: Don't swallow `EVENT_PUBLISH` failures here. The handler still returns `{ ok: true }` after a failed publish, so webhook deliveries can be reported as successful even though nothing was emitted to the Event Bus.</violation>
</file>

<file name="github/server/types/env.ts">

<violation number="1" location="github/server/types/env.ts:10">
P1: This required `EVENT_BUS` binding will not be available on `/webhooks/github`, so it adds config surface without enabling the webhook publish path.</violation>
</file>

<file name="github/server/main.ts">

<violation number="1" location="github/server/main.ts:100">
P1: This webhook path bypasses the mapped connection's runtime state, so Event Bus publishing can silently no-op even after `installationId` resolves to a valid `connectionId`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: This required EVENT_BUS binding will not be available on /webhooks/github, so it adds config surface without enabling the webhook publish path.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At github/server/types/env.ts, line 10:

<comment>This required `EVENT_BUS` binding will not be available on `/webhooks/github`, so it adds config surface without enabling the webhook publish path.</comment>

<file context>
@@ -3,14 +3,12 @@
- */
-export const StateSchema = z.object({});
+export const StateSchema = z.object({
+  EVENT_BUS: BindingOf("@deco/event-bus"),
+});
 
</file context>

[cubic-dev-ai]

3 issues found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="github/server/lib/event-bus.ts">

<violation number="1" location="github/server/lib/event-bus.ts:18">
P1: This singleton publisher will send every webhook through the last connection that ran `onChange`, so multi-connection installs can publish into the wrong Event Bus context.</violation>

<violation number="2" location="github/server/lib/event-bus.ts:34">
P1: Returning here silently drops the webhook event. `handleGitHubWebhook` treats only thrown errors as publish failures, so this path acknowledges the request even though nothing reached the Event Bus.</violation>
</file>

<file name="github/server/main.ts">

<violation number="1">
P1: This webhook path can silently drop valid events until `onChange` has populated the global publisher cache.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Returning here silently drops the webhook event. handleGitHubWebhook treats only thrown errors as publish failures, so this path acknowledges the request even though nothing reached the Event Bus.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At github/server/lib/event-bus.ts, line 34:

<comment>Returning here silently drops the webhook event. `handleGitHubWebhook` treats only thrown errors as publish failures, so this path acknowledges the request even though nothing reached the Event Bus.</comment>

<file context>
@@ -0,0 +1,38 @@
+    console.warn(
+      "[EventBus] No publisher available — EVENT_BUS not yet configured",
+    );
+    return;
+  }
+
</file context>

Suggested change

	return;
	throw new Error("EVENT_BUS not yet configured");

[cubic-dev-ai]

P1: This singleton publisher will send every webhook through the last connection that ran onChange, so multi-connection installs can publish into the wrong Event Bus context.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At github/server/lib/event-bus.ts, line 18:

<comment>This singleton publisher will send every webhook through the last connection that ran `onChange`, so multi-connection installs can publish into the wrong Event Bus context.</comment>

<file context>
@@ -0,0 +1,38 @@
+let cachedPublish: EventPublishFn | null = null;
+
+export function setEventPublisher(publish: EventPublishFn): void {
+  cachedPublish = publish;
+}
+
</file context>

[cubic-dev-ai]

P1: This webhook path can silently drop valid events until onChange has populated the global publisher cache.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At github/server/main.ts, line 107:

<comment>This webhook path can silently drop valid events until `onChange` has populated the global publisher cache.</comment>

<file context>
@@ -97,7 +104,7 @@ const wrappedFetch: typeof runtime.fetch = async (req, env, ctx) => {
   // GitHub webhook endpoint (unauthenticated — signature-verified instead)
   if (req.method === "POST" && url.pathname === "/webhooks/github") {
-    return handleGitHubWebhook(req, env);
+    return handleGitHubWebhook(req);
   }
 
</file context>