feat(server): Java webhook runtime role; restarts no longer drop events

.github/CODEOWNERS

@@ -9,12 +9,10 @@
 .releaserc                       @ls1intum/hephaestus-maintainers
 renovate.json                    @ls1intum/hephaestus-maintainers
 
-# Application Server (Java/Spring)
+# Application Server (Java/Spring) — includes the gitprovider.webhook receiver
+# deployed as the webhook-server container (see ADR 0008)
 server/       @ls1intum/hephaestus-maintainers
 
-# Webhook Ingest (TypeScript/Hono)
-webhook-ingest/           @ls1intum/hephaestus-maintainers
-
 # Webapp (React/TypeScript)
 webapp/                          @ls1intum/hephaestus-maintainers
 

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -48,7 +48,7 @@ body:
       options:
         - Webapp (React UI)
         - Application Server (Java/Spring, includes Pi mentor agent)
-        - Webhook Ingest
+        - Webhook Server (inbound webhook receiver)
         - Don't know
     validations:
       required: true

.github/labeler.yml

@@ -13,10 +13,6 @@ application-server:
   - changed-files:
     - any-glob-to-any-file: server/**
 
-webhook-ingest:
-  - changed-files:
-    - any-glob-to-any-file: "webhook-ingest/**"
-
 ci:
   - changed-files:
     - any-glob-to-any-file:

.github/prompts/fix-ci.prompt.md

@@ -1,6 +1,6 @@
 ---
-mode: agent
 description: Diagnose and fix ALL failing CI checks on the current PR in a single pass
+subtask: true
 ---
 
 # Fix CI
@@ -58,10 +58,9 @@ Before fixing anything, categorize every failure into this table.
 | 1 | Formatting | "Formatting failed", biome/prettier diff | `pnpm run format` |
 | 2 | Lint | Biome lint errors | `pnpm run check:fix` |
 | 3 | TypeScript | TS2xxx errors, type mismatch | Fix the type error in source |
-| 4 | Build failure | Compilation errors, missing exports | Fix imports/exports, verify with `pnpm run build:webhook-ingest` |
+| 4 | Build failure | Compilation errors, missing exports | Fix imports/exports, verify with `pnpm run build:webapp` |
 | 5 | Webapp tests | "FAIL" in webapp test output | Fix test or source, verify with `pnpm run test:webapp` |
 | 5 | App server tests | Maven test failures, assertion errors | Fix test or source, verify with `cd server && ./mvnw test -Dsurefire.includedGroups="unit" -Dmaven.test.skip=false -T 2C --batch-mode -q` |
-| 5 | Webhook tests | Vitest failures in webhook-ingest | Fix test or source, verify with `pnpm run test:webhook-ingest` |
 | 6 | OpenAPI sync | "OpenAPI out of sync" | `pnpm run generate:api` |
 | 6 | DB schema | "Schema drift detected" | `pnpm run db:draft-changelog` |
 | 6 | DB ERD | "ERD outdated" | `pnpm run db:generate-erd-docs` |
@@ -88,9 +87,6 @@ Then run tests for ALL components that had failures:
 # If webapp tests failed:
 pnpm run test:webapp
 
-# If webhook-ingest tests failed:
-pnpm run test:webhook-ingest
-
 # If app-server tests failed:
 cd server && ./mvnw test -Dsurefire.includedGroups="unit" -Dmaven.test.skip=false -T 2C --batch-mode -q && cd ../..
 ```

.github/prompts/land-pr.prompt.md

@@ -1,6 +1,6 @@
 ---
-mode: agent
 description: Validate, branch, commit, and create PR following Hephaestus conventions
+subtask: true
 ---
 
 # Land PR
@@ -21,9 +21,8 @@ git diff --name-only HEAD
 
 Map paths to components (mirrors CI's dorny/paths-filter config):
 - `webapp/**` → webapp changed
-- `server/**` OR `scripts/db-utils.sh` → app-server changed
-- `webhook-ingest/**` → webhook changed
-- `package.json` OR `package-lock.json` OR `.node-version` → webapp + webhook changed
+- `server/**` OR `scripts/db-utils.sh` → app-server changed (includes webhook receiver since ADR 0008)
+- `package.json` OR `package-lock.json` OR `.node-version` → webapp changed
 - `docs/**` → docs-only (skip all validation if nothing else changed)
 
 ## 3. Format
@@ -59,26 +58,14 @@ pnpm run db:draft-changelog
 pnpm run db:generate-erd-docs
 ```
 
-## 6. Build Affected TS Services
+## 6. Build Affected Services
 
-If webhook changed:
-
-```bash
-pnpm run build:webhook-ingest
-```
-
-Build failures catch path alias and import issues that typecheck alone misses.
+(No standalone TS services left — webhook receiver is part of `server/`.)
 
 ## 7. Unit Tests for Affected Components
 
 Run ONLY tests for changed components. Order: fastest first.
 
-If webhook changed:
-
-```bash
-pnpm run test:webhook-ingest
-```
-
 If webapp changed:
 
 ```bash
@@ -138,7 +125,7 @@ git commit -m "<type>(<scope>): <description>"
 
 **Scopes:**
 
-- Service: `webapp`, `server`, `ai`, `webhooks`, `docs`
+- Service: `webapp`, `server`, `docs`
 - Infra (no release): `ci`, `config`, `deps`, `deps-dev`, `docker`, `scripts`, `security`, `db`, `no-release`
 - Feature: `gitprovider`, `leaderboard`, `mentor`, `notifications`, `profile`, `teams`, `workspace`
 

.github/workflows/ci-docker-build.yml

@@ -20,11 +20,6 @@ on:
         required: false
         type: string
         default: "true"
-      webhook_ingest_changed:
-        description: "Whether webhook-ingest files changed (or should build for other reasons)"
-        required: false
-        type: string
-        default: "true"
       agent_images_changed:
         description: "Whether agent image files changed (or should build for other reasons)"
         required: false
@@ -76,29 +71,10 @@ jobs:
         org.opencontainers.image.licenses=MIT
         hephaestus.component=application-server
 
-  webhook-ingest-build:
-    name: "Webhook"
-    if: inputs.should_skip != 'true' && inputs.webhook_ingest_changed == 'true'
-    uses: ./.github/workflows/reusable-docker-build.yml
-    with:
-      image-name: "ls1intum/hephaestus/webhook-ingest"
-      docker-file: "./webhook-ingest/Dockerfile"
-      # Context = repo root so the Dockerfile can COPY pnpm-lock.yaml,
-      # pnpm-workspace.yaml, and the workspace package.json files needed for
-      # `pnpm install --filter webhook-ingest...` to resolve the workspace graph.
-      docker-context: "."
-      registry: "ghcr.io"
-      tags: |
-        ${{ github.ref_name }}
-        ${{ github.sha }}
-        ci-${{ github.run_number }}
-        ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || 'latest' }}
-      labels: |
-        org.opencontainers.image.title=Hephaestus Webhook Ingest
-        org.opencontainers.image.description=Hono/TypeScript-based webhook processor for Hephaestus
-        org.opencontainers.image.vendor=AET TUM
-        org.opencontainers.image.licenses=MIT
-        hephaestus.component=webhook-ingest
+  # Note: the inbound webhook receiver lives in the application-server image
+  # (gitprovider.webhook package) and is deployed as a separate container via
+  # SPRING_PROFILES_ACTIVE=prod,webhook. No separate image build is required. See
+  # docker/compose.core.yaml (webhook-server service) and ADR 0008.
 
   agent-pi-build:
     name: "Agent: Pi"

.github/workflows/ci-quality-gates.yml

@@ -19,11 +19,6 @@ on:
         required: false
         type: string
         default: "true"
-      webhook_ingest_changed:
-        description: "Whether webhook-ingest files changed (or should run for other reasons)"
-        required: false
-        type: string
-        default: "true"
 
 jobs:
   quality-gates:
@@ -39,8 +34,6 @@ jobs:
             display-name: "App Server"
           - check: webapp-quality
             display-name: "Webapp"
-          - check: webhook-ingest-quality
-            display-name: "Webhook"
           - check: openapi-validation
             display-name: "OpenAPI"
           - check: database-validation
@@ -56,9 +49,6 @@ jobs:
             "application-server-quality"|"openapi-validation"|"database-validation")
               echo "run=${{ inputs.application_server_changed }}" >> $GITHUB_OUTPUT
               ;;
-            "webhook-ingest-quality")
-              echo "run=${{ inputs.webhook_ingest_changed }}" >> $GITHUB_OUTPUT
-              ;;
             *)
               # Unknown check type - fail explicitly to catch missing case statements
               echo "::error::Unknown check type '${{ matrix.check }}' in ci-quality-gates.yml matrix."
@@ -141,31 +131,6 @@ jobs:
             exit 1
           fi
 
-      - name: Webhook-ingest quality
-        if: steps.should_run.outputs.run == 'true' && matrix.check == 'webhook-ingest-quality'
-        run: |
-          pnpm install --frozen-lockfile
-
-          ISSUES_FOUND=()
-          CHECK_OK=true; TYPES_OK=true; TEST_OK=true; BUILD_OK=true
-
-          pnpm --filter webhook-ingest run check || { CHECK_OK=false; ISSUES_FOUND+=("Biome check failed. Run: pnpm --filter webhook-ingest run check"); }
-          pnpm --filter webhook-ingest run typecheck || { TYPES_OK=false; ISSUES_FOUND+=("TypeScript failed. Run: pnpm run typecheck:webhook-ingest"); }
-          pnpm --filter webhook-ingest run test || { TEST_OK=false; ISSUES_FOUND+=("Tests failed. Run: pnpm run test:webhook-ingest"); }
-          pnpm --filter webhook-ingest run build || { BUILD_OK=false; ISSUES_FOUND+=("Build failed. Run: pnpm run build:webhook-ingest"); }
-
-          if [ ${#ISSUES_FOUND[@]} -gt 0 ]; then
-            echo "### Webhook Ingest Quality" >> $GITHUB_STEP_SUMMARY
-            echo "| Check | Status | Fix |" >> $GITHUB_STEP_SUMMARY
-            echo "|-------|--------|-----|" >> $GITHUB_STEP_SUMMARY
-            [[ "$CHECK_OK" == "false" ]] && echo "| Biome (lint + format) | :x: Failed | \`pnpm --filter webhook-ingest run check\` |" >> $GITHUB_STEP_SUMMARY
-            [[ "$TYPES_OK" == "false" ]] && echo "| TypeScript | :x: Failed | \`pnpm run typecheck:webhook-ingest\` |" >> $GITHUB_STEP_SUMMARY
-            [[ "$TEST_OK" == "false" ]] && echo "| Tests | :x: Failed | \`pnpm run test:webhook-ingest\` |" >> $GITHUB_STEP_SUMMARY
-            [[ "$BUILD_OK" == "false" ]] && echo "| Build | :x: Failed | \`pnpm run build:webhook-ingest\` |" >> $GITHUB_STEP_SUMMARY
-            for issue in "${ISSUES_FOUND[@]}"; do echo "::error::$issue"; done
-            exit 1
-          fi
-
       - name: OpenAPI validation
         if: steps.should_run.outputs.run == 'true' && matrix.check == 'openapi-validation'
         env:

.github/workflows/ci-tests.yml

@@ -19,11 +19,6 @@ on:
         required: false
         type: string
         default: "true"
-      webhook_ingest_changed:
-        description: "Whether webhook-ingest files changed"
-        required: false
-        type: string
-        default: "true"
 
 jobs:
   tests:
@@ -49,8 +44,6 @@ jobs:
             display-name: "Webapp: Storybook"
           - test-type: webapp-visual
             display-name: "Webapp: Visual"
-          - test-type: webhook-ingest-unit
-            display-name: "Webhook: Unit"
 
     steps:
       - name: Determine if test should run
@@ -63,9 +56,6 @@ jobs:
             "application-server-unit-arch"|"application-server-integration")
               echo "run=${{ inputs.application_server_changed }}" >> $GITHUB_OUTPUT
               ;;
-            "webhook-ingest-unit")
-              echo "run=${{ inputs.webhook_ingest_changed }}" >> $GITHUB_OUTPUT
-              ;;
             *)
               # Unknown test type - fail explicitly to catch missing case statements
               echo "::error::Unknown test type '${{ matrix.test-type }}' in ci-tests.yml matrix."
@@ -131,13 +121,6 @@ jobs:
               ;;
           esac
 
-      - name: Run tests
-        if: steps.should_run.outputs.run == 'true' && matrix.test-type == 'webhook-ingest-unit'
-        run: |
-          pnpm install --frozen-lockfile
-          cd webhook-ingest
-          pnpm run test
-
       # Chromatic visual testing
       - name: "Chromatic Visual Testing"
         if: steps.should_run.outputs.run == 'true' && matrix.test-type == 'webapp-visual'
@@ -217,15 +200,6 @@ jobs:
           reporter: java-junit
           fail-on-error: false
 
-      - name: Upload webhook-ingest test results
-        if: steps.should_run.outputs.run == 'true' && always() && matrix.test-type == 'webhook-ingest-unit'
-        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
-        with:
-          name: "Test Results - ${{ matrix.test-type }}"
-          path: "webhook-ingest/test-results/junit-*.xml"
-          reporter: java-junit
-          fail-on-error: false
-
       # Test Summary for Job Summary
       - name: Generate test summary
         if: steps.should_run.outputs.run == 'true' && always()
@@ -246,7 +220,4 @@ jobs:
             webapp-*)
               echo "✅ Webapp tests completed." >> $GITHUB_STEP_SUMMARY
               ;;
-            webhook-ingest-*)
-              echo "✅ Webhook ingest tests completed." >> $GITHUB_STEP_SUMMARY
-              ;;
           esac

.github/workflows/cicd.yml

@@ -21,11 +21,10 @@ jobs:
     outputs:
       webapp: ${{ steps.filter.outputs.webapp }}
       application-server: ${{ steps.filter.outputs.application-server }}
-      webhook-ingest: ${{ steps.filter.outputs.webhook-ingest }}
       agent-images: ${{ steps.filter.outputs.agent-images }}
       docs: ${{ steps.filter.outputs.docs }}
       ci-config: ${{ steps.filter.outputs.ci-config }}
-      any-code: ${{ steps.filter.outputs.webapp == 'true' || steps.filter.outputs.application-server == 'true' || steps.filter.outputs.webhook-ingest == 'true' || steps.filter.outputs.agent-images == 'true' }}
+      any-code: ${{ steps.filter.outputs.webapp == 'true' || steps.filter.outputs.application-server == 'true' || steps.filter.outputs.agent-images == 'true' }}
       should_skip: ${{ steps.skip_check.outputs.should_skip }}
     timeout-minutes: 5
     steps:
@@ -50,10 +49,6 @@ jobs:
             application-server:
               - 'server/**'
               - 'scripts/db-utils.sh'
-            webhook-ingest:
-              - 'webhook-ingest/**'
-              - 'package.json'
-              - 'package-lock.json'
             agent-images:
               - 'docker/agents/**'
             docs:
@@ -100,7 +95,6 @@ jobs:
       should_skip: ${{ needs.detect-changes.outputs.should_skip }}
       webapp_changed: ${{ (needs.detect-changes.outputs.webapp == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
       application_server_changed: ${{ (needs.detect-changes.outputs.application-server == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
-      webhook_ingest_changed: ${{ (needs.detect-changes.outputs.webhook-ingest == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
 
   Security:
     uses: ./.github/workflows/ci-security-scan.yml
@@ -129,7 +123,6 @@ jobs:
       should_skip: ${{ needs.detect-changes.outputs.should_skip }}
       webapp_changed: ${{ (needs.detect-changes.outputs.webapp == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
       application_server_changed: ${{ (needs.detect-changes.outputs.application-server == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
-      webhook_ingest_changed: ${{ (needs.detect-changes.outputs.webhook-ingest == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
 
   Docker:
     uses: ./.github/workflows/ci-docker-build.yml
@@ -145,7 +138,6 @@ jobs:
       should_skip: ${{ needs.detect-changes.outputs.should_skip }}
       webapp_changed: ${{ (needs.detect-changes.outputs.webapp == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
       application_server_changed: ${{ (needs.detect-changes.outputs.application-server == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
-      webhook_ingest_changed: ${{ (needs.detect-changes.outputs.webhook-ingest == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
       agent_images_changed: ${{ (needs.detect-changes.outputs.agent-images == 'true' || needs.detect-changes.outputs.ci-config == 'true' || github.event_name != 'pull_request') && 'true' || 'false' }}
 
   all-ci-passed:
@@ -230,7 +222,6 @@ jobs:
           echo "|-----------|---------|" >> $GITHUB_STEP_SUMMARY
           echo "| Webapp | ${{ needs.detect-changes.outputs.webapp == 'true' && '✅ Yes' || '➖ No' }} |" >> $GITHUB_STEP_SUMMARY
           echo "| Application Server | ${{ needs.detect-changes.outputs.application-server == 'true' && '✅ Yes' || '➖ No' }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| Webhook Ingest | ${{ needs.detect-changes.outputs.webhook-ingest == 'true' && '✅ Yes' || '➖ No' }} |" >> $GITHUB_STEP_SUMMARY
           echo "| Agent Images | ${{ needs.detect-changes.outputs.agent-images == 'true' && '✅ Yes' || '➖ No' }} |" >> $GITHUB_STEP_SUMMARY
           echo "| CI Config | ${{ needs.detect-changes.outputs.ci-config == 'true' && '⚙️ Yes' || '➖ No' }} |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
@@ -266,7 +257,6 @@ jobs:
               echo "| Webapp unit | \`pnpm run test:webapp\` |" >> $GITHUB_STEP_SUMMARY
               echo "| Webapp Storybook | \`pnpm --filter webapp run test:storybook\` |" >> $GITHUB_STEP_SUMMARY
               echo "| Application server | \`cd server && ./mvnw test\` |" >> $GITHUB_STEP_SUMMARY
-              echo "| Webhook ingest | \`pnpm --filter webhook-ingest run test\` |" >> $GITHUB_STEP_SUMMARY
               echo "" >> $GITHUB_STEP_SUMMARY
               echo "**Tip:** Check the **Test Results** tab above for specific failures." >> $GITHUB_STEP_SUMMARY
               echo "" >> $GITHUB_STEP_SUMMARY

.github/workflows/deploy-prod.yml

@@ -14,7 +14,7 @@ on:
       deploy-core:
         default: false
         type: boolean
-        description: (Re-)deploys NATS, Keycloak, Webhook Ingest. Usually not necessary and might cause data gaps.
+        description: (Re-)deploys NATS, Keycloak, and the Webhook Server (application-server image with the webhook profile). Usually not necessary and might cause data gaps.
       deploy-proxy:
         default: false
         type: boolean
@@ -33,7 +33,7 @@ on:
       deploy-core:
         default: false
         type: boolean
-        description: (Re-)deploys NATS, Keycloak, Webhook Ingest. Usually not necessary and might cause data gaps.
+        description: (Re-)deploys NATS, Keycloak, and the Webhook Server (application-server image with the webhook profile). Usually not necessary and might cause data gaps.
       deploy-proxy:
         default: false
         type: boolean
@@ -61,7 +61,9 @@ jobs:
     with:
       environment: Production
       docker-compose-file: "./docker/compose.core.yaml"
-      main-image-name: ls1intum/hephaestus/webhook-ingest
+      # compose.core.yaml now runs `webhook-server` from the application-server image
+      # (SPRING_PROFILES_ACTIVE=prod,webhook). See ADR 0008.
+      main-image-name: ls1intum/hephaestus/application-server
       image-tag: ${{ inputs.image-tag }}
       deployment-base-path: "/opt/hephaestus/core"
     secrets: inherit