TODO (#173)

Reviewed-on: #173

README.md

@@ -1,12 +1,12 @@
 # µPaaS by [@sneak](https://sneak.berlin)
 
-A simple self-hosted PaaS that auto-deploys Docker containers from Git repositories via Gitea webhooks.
+A simple self-hosted PaaS that auto-deploys Docker containers from Git repositories via webhooks from Gitea, GitHub, or GitLab.
 
 ## Features
 
 - Single admin user with argon2id password hashing
 - Per-app SSH keypairs for read-only deploy keys
-- Per-app UUID-based webhook URLs for Gitea integration
+- Per-app UUID-based webhook URLs with auto-detection of Gitea, GitHub, and GitLab
 - Branch filtering - only deploy on configured branch changes
 - Environment variables, labels, and volume mounts per app
 - CPU and memory resource limits per app
@@ -20,7 +20,7 @@ A simple self-hosted PaaS that auto-deploys Docker containers from Git repositor
 - Complex CI pipelines
 - Multiple container orchestration
 - SPA/API-first design
-- Support for non-Gitea webhooks
+- Support for non-push webhook events (e.g. issues, merge requests)
 
 ## Architecture
 
@@ -45,7 +45,7 @@ upaas/
 │   │   ├── auth/        # Authentication service
 │   │   ├── deploy/      # Deployment orchestration
 │   │   ├── notify/      # Notifications (ntfy, Slack)
-│   │   └── webhook/     # Gitea webhook processing
+│   │   └── webhook/     # Webhook processing (Gitea, GitHub, GitLab)
 │   └── ssh/             # SSH key generation
 ├── static/              # Embedded CSS/JS assets
 └── templates/           # Embedded HTML templates

TODO.md

@@ -0,0 +1,53 @@
+# Workflow
+
+* branch (from `main`)
+* do the work in Next Step
+* move Next Step to the top of Completed Steps
+* move the top item of Future Steps into Next Step
+* commit (`TODO.md` changes in the same commit as the work)
+* merge to `main` if the branch is not protected, otherwise open a PR
+* push
+
+# Status
+
+1.0+. Tagged 1.0.0 on 2026-02-26; 8 commits on main since. Policy
+violation: main currently fails make check (91 lint issues), so the tree
+is out of compliance until fixed.
+
+# Next Step
+
+Fix the 47 noctx lint findings (HTTP requests without context) in one
+commit and confirm the count drops under make check. This is the largest
+of the three lint classes blocking a green main.
+
+# Completed Steps
+
+- 2026-03-11: Monolithic env var editing with bulk save (#158).
+- 2026-03-10: Webhook event history UI page (#164); added missing
+  Makefile docker and hooks targets plus test timeout (#159);
+  notification settings passed from create form (#160).
+- 2026-03-03: REPO_POLICIES compliance file set added (#155).
+- 2026-03-01: Module path changed to sneak.berlin/go/upaas (#143);
+  Dockerfile split into lint and build stages with forced lint
+  execution (#152, #154).
+- 2026-02-26: 1.0.0 tagged; dashboard CSRFField crash fixed (#146).
+- 1.0 audit bug fixes (#120-#125): deferred rollback on commit error,
+  deployment log size cap, error path rendering, docker-compose bind
+  mount, domain type refactor.
+- CI simplified to docker build only (#130).
+- 2025-12-29 onward: core PaaS built out: deploys with real-time build
+  log streaming, container start/stop/restart and logs, TCP/UDP port
+  mapping, Alpine.js UI, Slack notifications, ULID app IDs, session
+  handling.
+
+# Future Steps
+
+- Get main green (compliance, ordered):
+    - Fix 47 noctx findings (Next Step).
+    - Fix 23 gosec findings.
+    - Fix 21 goconst findings.
+    - Run make check clean on main and keep it green; main must always
+      pass.
+- Confirm .gitea/workflows/check.yml gates merges on make check so main
+  cannot regress.
+- Resume feature work only after main is green.

internal/database/migrations.go

@@ -2,36 +2,74 @@ package database
 
 import (
 	"context"
+	"database/sql"
 	"embed"
+	"errors"
 	"fmt"
 	"io/fs"
+	"log/slog"
 	"sort"
+	"strconv"
 	"strings"
 )
 
 //go:embed migrations/*.sql
 var migrationsFS embed.FS
 
-func (d *Database) migrate(ctx context.Context) error {
+// bootstrapVersion is the migration that creates the schema_migrations
-	// Create migrations table if not exists
+// table itself. It is applied before the normal migration loop.
-	_, err := d.database.ExecContext(ctx, `
+const bootstrapVersion = 0
-		CREATE TABLE IF NOT EXISTS schema_migrations (
+
-			version TEXT PRIMARY KEY,
+// ErrInvalidMigrationFilename indicates a migration filename does not follow
-			applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+// the expected "<version>.sql" or "<version>_<description>.sql" pattern.
-		)
+var ErrInvalidMigrationFilename = errors.New("invalid migration filename")
-	`)
+
-	if err != nil {
+// ParseMigrationVersion extracts the numeric version prefix from a migration
-		return fmt.Errorf("failed to create migrations table: %w", err)
+// filename. Filenames must follow the pattern "<version>.sql" or
+// "<version>_<description>.sql", where version is a zero-padded numeric
+// string (e.g. "001", "002"). Returns the version as an integer and an
+// error if the filename does not match the expected pattern.
+func ParseMigrationVersion(filename string) (int, error) {
+	name := strings.TrimSuffix(filename, ".sql")
+	if name == "" || name == filename {
+		return 0, fmt.Errorf("%w: %q has no .sql extension or is empty", ErrInvalidMigrationFilename, filename)
 	}
 
-	// Get list of migration files
+	// Split on underscore to separate version from description.
+	// If there's no underscore, the entire stem is the version.
+	versionStr, _, _ := strings.Cut(name, "_")
+
+	if versionStr == "" {
+		return 0, fmt.Errorf("%w: %q has empty version prefix", ErrInvalidMigrationFilename, filename)
+	}
+
+	// Validate the version is purely numeric.
+	for _, ch := range versionStr {
+		if ch < '0' || ch > '9' {
+			return 0, fmt.Errorf(
+				"%w: %q version %q contains non-numeric character %q",
+				ErrInvalidMigrationFilename, filename, versionStr, string(ch),
+			)
+		}
+	}
+
+	version, err := strconv.Atoi(versionStr)
+	if err != nil {
+		return 0, fmt.Errorf("%w: %q: %w", ErrInvalidMigrationFilename, filename, err)
+	}
+
+	return version, nil
+}
+
+// collectMigrations reads the embedded migrations directory and returns
+// migration filenames sorted lexicographically.
+func collectMigrations() ([]string, error) {
 	entries, err := fs.ReadDir(migrationsFS, "migrations")
 	if err != nil {
-		return fmt.Errorf("failed to read migrations directory: %w", err)
+		return nil, fmt.Errorf("failed to read migrations directory: %w", err)
 	}
 
-	// Sort migrations by name
+	var migrations []string
-	migrations := make([]string, 0, len(entries))
 
 	for _, entry := range entries {
 		if !entry.IsDir() && strings.HasSuffix(entry.Name(), ".sql") {
@@ -41,54 +79,113 @@ func (d *Database) migrate(ctx context.Context) error {
 
 	sort.Strings(migrations)
 
-	// Apply each migration
+	return migrations, nil
-	for _, migration := range migrations {
+}
-		applied, err := d.isMigrationApplied(ctx, migration)
-		if err != nil {
-			return fmt.Errorf("failed to check migration %s: %w", migration, err)
-		}
 
-		if applied {
+// bootstrapMigrationsTable ensures the schema_migrations table exists by
-			d.log.Debug("migration already applied", "migration", migration)
+// applying 000_migration.sql if the table is missing.
+func bootstrapMigrationsTable(ctx context.Context, db *sql.DB, log *slog.Logger) error {
+	var tableExists int
 
-			continue
+	err := db.QueryRowContext(ctx,
-		}
+		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='schema_migrations'",
+	).Scan(&tableExists)
+	if err != nil {
+		return fmt.Errorf("failed to check for migrations table: %w", err)
+	}
 
-		err = d.applyMigration(ctx, migration)
+	if tableExists == 0 {
-		if err != nil {
+		return applyBootstrapMigration(ctx, db, log)
-			return fmt.Errorf("failed to apply migration %s: %w", migration, err)
-		}
-
-		d.log.Info("migration applied", "migration", migration)
 	}
 
 	return nil
 }
 
-func (d *Database) isMigrationApplied(ctx context.Context, version string) (bool, error) {
+// applyBootstrapMigration reads and executes 000_migration.sql to create the
-	var count int
+// schema_migrations table on a fresh database.
-
+func applyBootstrapMigration(ctx context.Context, db *sql.DB, log *slog.Logger) error {
-	err := d.database.QueryRowContext(
+	content, err := migrationsFS.ReadFile("migrations/000_migration.sql")
-		ctx,
-		"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
-		version,
-	).Scan(&count)
 	if err != nil {
-		return false, fmt.Errorf("failed to query migration status: %w", err)
+		return fmt.Errorf("failed to read bootstrap migration 000_migration.sql: %w", err)
 	}
 
-	return count > 0, nil
+	if log != nil {
+		log.Info("applying bootstrap migration", "version", bootstrapVersion)
+	}
+
+	_, err = db.ExecContext(ctx, string(content))
+	if err != nil {
+		return fmt.Errorf("failed to apply bootstrap migration: %w", err)
+	}
+
+	return nil
 }
 
-func (d *Database) applyMigration(ctx context.Context, filename string) error {
+// ApplyMigrations applies all pending migrations to db. An optional logger
-	content, err := migrationsFS.ReadFile("migrations/" + filename)
+// may be provided for informational output; pass nil for silent operation.
-	if err != nil {
+// This is exported so tests can apply the real schema without the full fx
-		return fmt.Errorf("failed to read migration file: %w", err)
+// lifecycle.
+func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
+	bootstrapErr := bootstrapMigrationsTable(ctx, db, log)
+	if bootstrapErr != nil {
+		return bootstrapErr
 	}
 
-	transaction, err := d.database.BeginTx(ctx, nil)
+	migrations, err := collectMigrations()
 	if err != nil {
-		return fmt.Errorf("failed to begin transaction: %w", err)
+		return err
+	}
+
+	for _, migration := range migrations {
+		version, parseErr := ParseMigrationVersion(migration)
+		if parseErr != nil {
+			return parseErr
+		}
+
+		// Check if already applied.
+		var count int
+
+		err = db.QueryRowContext(ctx,
+			"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
+			version,
+		).Scan(&count)
+		if err != nil {
+			return fmt.Errorf("failed to check migration %s: %w", migration, err)
+		}
+
+		if count > 0 {
+			if log != nil {
+				log.Debug("migration already applied", "version", version)
+			}
+
+			continue
+		}
+
+		// Apply migration in a transaction.
+		applyErr := applyMigrationTx(ctx, db, migration, version)
+		if applyErr != nil {
+			return applyErr
+		}
+
+		if log != nil {
+			log.Info("migration applied", "version", version)
+		}
+	}
+
+	return nil
+}
+
+// applyMigrationTx reads and executes a migration file within a transaction,
+// recording the version in schema_migrations on success.
+func applyMigrationTx(ctx context.Context, db *sql.DB, filename string, version int) error {
+	content, err := migrationsFS.ReadFile("migrations/" + filename)
+	if err != nil {
+		return fmt.Errorf("failed to read migration %s: %w", filename, err)
+	}
+
+	transaction, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("failed to begin transaction for migration %s: %w", filename, err)
 	}
 
 	defer func() {
@@ -97,26 +194,27 @@ func (d *Database) applyMigration(ctx context.Context, filename string) error {
 		}
 	}()
 
-	// Execute migration
 	_, err = transaction.ExecContext(ctx, string(content))
 	if err != nil {
-		return fmt.Errorf("failed to execute migration: %w", err)
+		return fmt.Errorf("failed to execute migration %s: %w", filename, err)
 	}
 
-	// Record migration
+	_, err = transaction.ExecContext(ctx,
-	_, err = transaction.ExecContext(
-		ctx,
 		"INSERT INTO schema_migrations (version) VALUES (?)",
-		filename,
+		version,
 	)
 	if err != nil {
-		return fmt.Errorf("failed to record migration: %w", err)
+		return fmt.Errorf("failed to record migration %s: %w", filename, err)
 	}
 
 	err = transaction.Commit()
 	if err != nil {
-		return fmt.Errorf("failed to commit migration: %w", err)
+		return fmt.Errorf("failed to commit migration %s: %w", filename, err)
 	}
 
 	return nil
 }
+
+func (d *Database) migrate(ctx context.Context) error {
+	return ApplyMigrations(ctx, d.database, d.log)
+}

internal/database/migrations/000_migration.sql

@@ -0,0 +1,9 @@
+-- Migration 000: Schema migrations tracking table
+-- Applied as a bootstrap step before the normal migration loop.
+
+CREATE TABLE IF NOT EXISTS schema_migrations (
+    version INTEGER PRIMARY KEY,
+    applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+INSERT OR IGNORE INTO schema_migrations (version) VALUES (0);

internal/database/migrations_test.go

@@ -0,0 +1,117 @@
+package database_test
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	_ "github.com/mattn/go-sqlite3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"sneak.berlin/go/upaas/internal/database"
+)
+
+func TestParseMigrationVersion(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		filename    string
+		wantVersion int
+		wantErr     bool
+	}{
+		{filename: "000_migration.sql", wantVersion: 0},
+		{filename: "001_initial.sql", wantVersion: 1},
+		{filename: "002_remove_container_id.sql", wantVersion: 2},
+		{filename: "007_add_resource_limits.sql", wantVersion: 7},
+		{filename: "100_large_version.sql", wantVersion: 100},
+		{filename: ".sql", wantErr: true},
+		{filename: "_foo.sql", wantErr: true},
+		{filename: "abc_foo.sql", wantErr: true},
+		{filename: "1a2_bad.sql", wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.filename, func(t *testing.T) {
+			t.Parallel()
+
+			version, err := database.ParseMigrationVersion(tt.filename)
+			if tt.wantErr {
+				assert.Error(t, err)
+
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantVersion, version)
+		})
+	}
+}
+
+func TestApplyMigrationsFreshDatabase(t *testing.T) {
+	t.Parallel()
+
+	db, err := sql.Open("sqlite3", ":memory:?_foreign_keys=on")
+	require.NoError(t, err)
+
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	err = database.ApplyMigrations(ctx, db, nil)
+	require.NoError(t, err)
+
+	// Verify schema_migrations table exists with INTEGER version column.
+	var version int
+
+	err = db.QueryRowContext(ctx,
+		"SELECT version FROM schema_migrations WHERE version = 0",
+	).Scan(&version)
+	require.NoError(t, err)
+	assert.Equal(t, 0, version)
+
+	// Verify that all migrations were recorded.
+	var count int
+
+	err = db.QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM schema_migrations",
+	).Scan(&count)
+	require.NoError(t, err)
+	// 000 bootstrap + 001 through 007 = 8 entries.
+	assert.Equal(t, 8, count)
+
+	// Verify application tables were created by the migrations.
+	var tableCount int
+
+	err = db.QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='users'",
+	).Scan(&tableCount)
+	require.NoError(t, err)
+	assert.Equal(t, 1, tableCount)
+}
+
+func TestApplyMigrationsIdempotent(t *testing.T) {
+	t.Parallel()
+
+	db, err := sql.Open("sqlite3", ":memory:?_foreign_keys=on")
+	require.NoError(t, err)
+
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	// Apply twice — second run should be a no-op.
+	err = database.ApplyMigrations(ctx, db, nil)
+	require.NoError(t, err)
+
+	err = database.ApplyMigrations(ctx, db, nil)
+	require.NoError(t, err)
+
+	var count int
+
+	err = db.QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM schema_migrations",
+	).Scan(&count)
+	require.NoError(t, err)
+	assert.Equal(t, 8, count)
+}

internal/handlers/webhook.go

@@ -7,12 +7,14 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	"sneak.berlin/go/upaas/internal/models"
+	"sneak.berlin/go/upaas/internal/service/webhook"
 )
 
 // maxWebhookBodySize is the maximum allowed size of a webhook request body (1MB).
 const maxWebhookBodySize = 1 << 20
 
-// HandleWebhook handles incoming Gitea webhooks.
+// HandleWebhook handles incoming webhooks from Gitea, GitHub, or GitLab.
+// The webhook source is auto-detected from HTTP headers.
 func (h *Handlers) HandleWebhook() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
 		secret := chi.URLParam(request, "secret")
@@ -50,16 +52,17 @@ func (h *Handlers) HandleWebhook() http.HandlerFunc {
 			return
 		}
 
-		// Get event type from header
+		// Auto-detect webhook source from headers
-		eventType := request.Header.Get("X-Gitea-Event")
+		source := webhook.DetectWebhookSource(request.Header)
-		if eventType == "" {
+
-			eventType = "push"
+		// Extract event type based on detected source
-		}
+		eventType := webhook.DetectEventType(request.Header, source)
 
 		// Process webhook
 		webhookErr := h.webhook.HandleWebhook(
 			request.Context(),
 			application,
+			source,
 			eventType,
 			body,
 		)

internal/service/webhook/payloads.go

@@ -0,0 +1,248 @@
+package webhook
+
+import "encoding/json"
+
+// GiteaPushPayload represents a Gitea push webhook payload.
+//
+//nolint:tagliatelle // Field names match Gitea API (snake_case)
+type GiteaPushPayload struct {
+	Ref        string      `json:"ref"`
+	Before     string      `json:"before"`
+	After      string      `json:"after"`
+	CompareURL UnparsedURL `json:"compare_url"`
+	Repository struct {
+		FullName string      `json:"full_name"`
+		CloneURL UnparsedURL `json:"clone_url"`
+		SSHURL   string      `json:"ssh_url"`
+		HTMLURL  UnparsedURL `json:"html_url"`
+	} `json:"repository"`
+	Pusher struct {
+		Username string `json:"username"`
+		Email    string `json:"email"`
+	} `json:"pusher"`
+	Commits []struct {
+		ID      string      `json:"id"`
+		URL     UnparsedURL `json:"url"`
+		Message string      `json:"message"`
+		Author  struct {
+			Name  string `json:"name"`
+			Email string `json:"email"`
+		} `json:"author"`
+	} `json:"commits"`
+}
+
+// GitHubPushPayload represents a GitHub push webhook payload.
+//
+//nolint:tagliatelle // Field names match GitHub API (snake_case)
+type GitHubPushPayload struct {
+	Ref        string `json:"ref"`
+	Before     string `json:"before"`
+	After      string `json:"after"`
+	CompareURL string `json:"compare"`
+	Repository struct {
+		FullName string      `json:"full_name"`
+		CloneURL UnparsedURL `json:"clone_url"`
+		SSHURL   string      `json:"ssh_url"`
+		HTMLURL  UnparsedURL `json:"html_url"`
+	} `json:"repository"`
+	Pusher struct {
+		Name  string `json:"name"`
+		Email string `json:"email"`
+	} `json:"pusher"`
+	HeadCommit *struct {
+		ID      string      `json:"id"`
+		URL     UnparsedURL `json:"url"`
+		Message string      `json:"message"`
+	} `json:"head_commit"`
+	Commits []struct {
+		ID      string      `json:"id"`
+		URL     UnparsedURL `json:"url"`
+		Message string      `json:"message"`
+		Author  struct {
+			Name  string `json:"name"`
+			Email string `json:"email"`
+		} `json:"author"`
+	} `json:"commits"`
+}
+
+// GitLabPushPayload represents a GitLab push webhook payload.
+//
+//nolint:tagliatelle // Field names match GitLab API (snake_case)
+type GitLabPushPayload struct {
+	Ref       string `json:"ref"`
+	Before    string `json:"before"`
+	After     string `json:"after"`
+	UserName  string `json:"user_name"`
+	UserEmail string `json:"user_email"`
+	Project   struct {
+		PathWithNamespace string      `json:"path_with_namespace"`
+		GitHTTPURL        UnparsedURL `json:"git_http_url"`
+		GitSSHURL         string      `json:"git_ssh_url"`
+		WebURL            UnparsedURL `json:"web_url"`
+	} `json:"project"`
+	Commits []struct {
+		ID      string      `json:"id"`
+		URL     UnparsedURL `json:"url"`
+		Message string      `json:"message"`
+		Author  struct {
+			Name  string `json:"name"`
+			Email string `json:"email"`
+		} `json:"author"`
+	} `json:"commits"`
+}
+
+// ParsePushPayload parses a raw webhook payload into a normalized PushEvent
+// based on the detected webhook source. Returns an error if JSON unmarshaling
+// fails. For SourceUnknown, falls back to Gitea format for backward
+// compatibility.
+func ParsePushPayload(source Source, payload []byte) (*PushEvent, error) {
+	switch source {
+	case SourceGitHub:
+		return parseGitHubPush(payload)
+	case SourceGitLab:
+		return parseGitLabPush(payload)
+	case SourceGitea, SourceUnknown:
+		// Gitea and unknown both use Gitea format for backward compatibility.
+		return parseGiteaPush(payload)
+	}
+
+	// Unreachable for known source values, but satisfies exhaustive checker.
+	return parseGiteaPush(payload)
+}
+
+func parseGiteaPush(payload []byte) (*PushEvent, error) {
+	var p GiteaPushPayload
+
+	unmarshalErr := json.Unmarshal(payload, &p)
+	if unmarshalErr != nil {
+		return nil, unmarshalErr
+	}
+
+	commitURL := extractGiteaCommitURL(p)
+
+	return &PushEvent{
+		Source:    SourceGitea,
+		Ref:       p.Ref,
+		Before:    p.Before,
+		After:     p.After,
+		Branch:    extractBranch(p.Ref),
+		RepoName:  p.Repository.FullName,
+		CloneURL:  p.Repository.CloneURL,
+		HTMLURL:   p.Repository.HTMLURL,
+		CommitURL: commitURL,
+		Pusher:    p.Pusher.Username,
+	}, nil
+}
+
+func parseGitHubPush(payload []byte) (*PushEvent, error) {
+	var p GitHubPushPayload
+
+	unmarshalErr := json.Unmarshal(payload, &p)
+	if unmarshalErr != nil {
+		return nil, unmarshalErr
+	}
+
+	commitURL := extractGitHubCommitURL(p)
+
+	return &PushEvent{
+		Source:    SourceGitHub,
+		Ref:       p.Ref,
+		Before:    p.Before,
+		After:     p.After,
+		Branch:    extractBranch(p.Ref),
+		RepoName:  p.Repository.FullName,
+		CloneURL:  p.Repository.CloneURL,
+		HTMLURL:   p.Repository.HTMLURL,
+		CommitURL: commitURL,
+		Pusher:    p.Pusher.Name,
+	}, nil
+}
+
+func parseGitLabPush(payload []byte) (*PushEvent, error) {
+	var p GitLabPushPayload
+
+	unmarshalErr := json.Unmarshal(payload, &p)
+	if unmarshalErr != nil {
+		return nil, unmarshalErr
+	}
+
+	commitURL := extractGitLabCommitURL(p)
+
+	return &PushEvent{
+		Source:    SourceGitLab,
+		Ref:       p.Ref,
+		Before:    p.Before,
+		After:     p.After,
+		Branch:    extractBranch(p.Ref),
+		RepoName:  p.Project.PathWithNamespace,
+		CloneURL:  p.Project.GitHTTPURL,
+		HTMLURL:   p.Project.WebURL,
+		CommitURL: commitURL,
+		Pusher:    p.UserName,
+	}, nil
+}
+
+// extractBranch extracts the branch name from a git ref.
+func extractBranch(ref string) string {
+	// refs/heads/main -> main
+	const prefix = "refs/heads/"
+
+	if len(ref) >= len(prefix) && ref[:len(prefix)] == prefix {
+		return ref[len(prefix):]
+	}
+
+	return ref
+}
+
+// extractGiteaCommitURL extracts the commit URL from a Gitea push payload.
+// Prefers the URL from the head commit, falls back to constructing from repo URL.
+func extractGiteaCommitURL(payload GiteaPushPayload) UnparsedURL {
+	for _, commit := range payload.Commits {
+		if commit.ID == payload.After && commit.URL != "" {
+			return commit.URL
+		}
+	}
+
+	if payload.Repository.HTMLURL != "" && payload.After != "" {
+		return UnparsedURL(payload.Repository.HTMLURL.String() + "/commit/" + payload.After)
+	}
+
+	return ""
+}
+
+// extractGitHubCommitURL extracts the commit URL from a GitHub push payload.
+// Prefers head_commit.url, then searches commits, then constructs from repo URL.
+func extractGitHubCommitURL(payload GitHubPushPayload) UnparsedURL {
+	if payload.HeadCommit != nil && payload.HeadCommit.URL != "" {
+		return payload.HeadCommit.URL
+	}
+
+	for _, commit := range payload.Commits {
+		if commit.ID == payload.After && commit.URL != "" {
+			return commit.URL
+		}
+	}
+
+	if payload.Repository.HTMLURL != "" && payload.After != "" {
+		return UnparsedURL(payload.Repository.HTMLURL.String() + "/commit/" + payload.After)
+	}
+
+	return ""
+}
+
+// extractGitLabCommitURL extracts the commit URL from a GitLab push payload.
+// Prefers commit URL from the commits list, falls back to constructing from
+// project web URL.
+func extractGitLabCommitURL(payload GitLabPushPayload) UnparsedURL {
+	for _, commit := range payload.Commits {
+		if commit.ID == payload.After && commit.URL != "" {
+			return commit.URL
+		}
+	}
+
+	if payload.Project.WebURL != "" && payload.After != "" {
+		return UnparsedURL(payload.Project.WebURL.String() + "/-/commit/" + payload.After)
+	}
+
+	return ""
+}

internal/service/webhook/types.go

@@ -1,5 +1,7 @@
 package webhook
 
+import "net/http"
+
 // UnparsedURL is a URL stored as a plain string without parsing.
 // Use this instead of string when the value is known to be a URL
 // but should not be parsed into a net/url.URL (e.g. webhook URLs,
@@ -8,3 +10,84 @@ type UnparsedURL string
 
 // String implements the fmt.Stringer interface.
 func (u UnparsedURL) String() string { return string(u) }
+
+// Source identifies which git hosting platform sent the webhook.
+type Source string
+
+const (
+	// SourceGitea indicates the webhook was sent by a Gitea instance.
+	SourceGitea Source = "gitea"
+
+	// SourceGitHub indicates the webhook was sent by GitHub.
+	SourceGitHub Source = "github"
+
+	// SourceGitLab indicates the webhook was sent by a GitLab instance.
+	SourceGitLab Source = "gitlab"
+
+	// SourceUnknown indicates the webhook source could not be determined.
+	SourceUnknown Source = "unknown"
+)
+
+// String implements the fmt.Stringer interface.
+func (s Source) String() string { return string(s) }
+
+// DetectWebhookSource determines the webhook source from HTTP headers.
+// It checks for platform-specific event headers in this order:
+// Gitea (X-Gitea-Event), GitHub (X-GitHub-Event), GitLab (X-Gitlab-Event).
+// Returns SourceUnknown if no recognized header is found.
+func DetectWebhookSource(headers http.Header) Source {
+	if headers.Get("X-Gitea-Event") != "" {
+		return SourceGitea
+	}
+
+	if headers.Get("X-Github-Event") != "" {
+		return SourceGitHub
+	}
+
+	if headers.Get("X-Gitlab-Event") != "" {
+		return SourceGitLab
+	}
+
+	return SourceUnknown
+}
+
+// DetectEventType extracts the event type string from HTTP headers
+// based on the detected webhook source. Returns "push" as a fallback
+// when no event header is found.
+func DetectEventType(headers http.Header, source Source) string {
+	switch source {
+	case SourceGitea:
+		if v := headers.Get("X-Gitea-Event"); v != "" {
+			return v
+		}
+	case SourceGitHub:
+		if v := headers.Get("X-Github-Event"); v != "" {
+			return v
+		}
+	case SourceGitLab:
+		if v := headers.Get("X-Gitlab-Event"); v != "" {
+			return v
+		}
+	case SourceUnknown:
+		// Fall through to default
+	}
+
+	return "push"
+}
+
+// PushEvent is a normalized representation of a push webhook payload
+// from any supported source (Gitea, GitHub, GitLab). The webhook
+// service converts source-specific payloads into this format before
+// processing.
+type PushEvent struct {
+	Source    Source
+	Ref       string
+	Before    string
+	After     string
+	Branch    string
+	RepoName  string
+	CloneURL  UnparsedURL
+	HTMLURL   UnparsedURL
+	CommitURL UnparsedURL
+	Pusher    string
+}

internal/service/webhook/webhook.go

@@ -4,7 +4,6 @@ package webhook
 import (
 	"context"
 	"database/sql"
-	"encoding/json"
 	"fmt"
 	"log/slog"
 
@@ -44,68 +43,46 @@ func New(_ fx.Lifecycle, params ServiceParams) (*Service, error) {
 	}, nil
 }
 
-// GiteaPushPayload represents a Gitea push webhook payload.
+// HandleWebhook processes a webhook request from any supported source
-//
+// (Gitea, GitHub, or GitLab). The source parameter determines which
-//nolint:tagliatelle // Field names match Gitea API (snake_case)
+// payload format to use for parsing.
-type GiteaPushPayload struct {
-	Ref        string      `json:"ref"`
-	Before     string      `json:"before"`
-	After      string      `json:"after"`
-	CompareURL UnparsedURL `json:"compare_url"`
-	Repository struct {
-		FullName string      `json:"full_name"`
-		CloneURL UnparsedURL `json:"clone_url"`
-		SSHURL   string      `json:"ssh_url"`
-		HTMLURL  UnparsedURL `json:"html_url"`
-	} `json:"repository"`
-	Pusher struct {
-		Username string `json:"username"`
-		Email    string `json:"email"`
-	} `json:"pusher"`
-	Commits []struct {
-		ID      string      `json:"id"`
-		URL     UnparsedURL `json:"url"`
-		Message string      `json:"message"`
-		Author  struct {
-			Name  string `json:"name"`
-			Email string `json:"email"`
-		} `json:"author"`
-	} `json:"commits"`
-}
-
-// HandleWebhook processes a webhook request.
 func (svc *Service) HandleWebhook(
 	ctx context.Context,
 	app *models.App,
+	source Source,
 	eventType string,
 	payload []byte,
 ) error {
-	svc.log.Info("processing webhook", "app", app.Name, "event", eventType)
+	svc.log.Info("processing webhook",
+		"app", app.Name,
+		"source", source.String(),
+		"event", eventType,
+	)
 
-	// Parse payload
+	// Parse payload into normalized push event
-	var pushPayload GiteaPushPayload
+	pushEvent, parseErr := ParsePushPayload(source, payload)
-
+	if parseErr != nil {
-	unmarshalErr := json.Unmarshal(payload, &pushPayload)
+		svc.log.Warn("failed to parse webhook payload",
-	if unmarshalErr != nil {
+			"error", parseErr,
-		svc.log.Warn("failed to parse webhook payload", "error", unmarshalErr)
+			"source", source.String(),
-		// Continue anyway to log the event
+		)
+		// Continue with empty push event to still log the webhook
+		pushEvent = &PushEvent{Source: source}
 	}
 
-	// Extract branch from ref
-	branch := extractBranch(pushPayload.Ref)
-	commitSHA := pushPayload.After
-	commitURL := extractCommitURL(pushPayload)
-
 	// Check if branch matches
-	matched := branch == app.Branch
+	matched := pushEvent.Branch == app.Branch
 
 	// Create webhook event record
 	event := models.NewWebhookEvent(svc.db)
 	event.AppID = app.ID
 	event.EventType = eventType
-	event.Branch = branch
+	event.Branch = pushEvent.Branch
-	event.CommitSHA = sql.NullString{String: commitSHA, Valid: commitSHA != ""}
+	event.CommitSHA = sql.NullString{String: pushEvent.After, Valid: pushEvent.After != ""}
-	event.CommitURL = sql.NullString{String: commitURL.String(), Valid: commitURL != ""}
+	event.CommitURL = sql.NullString{
+		String: pushEvent.CommitURL.String(),
+		Valid:  pushEvent.CommitURL != "",
+	}
 	event.Payload = sql.NullString{String: string(payload), Valid: true}
 	event.Matched = matched
 	event.Processed = false
@@ -117,9 +94,10 @@ func (svc *Service) HandleWebhook(
 
 	svc.log.Info("webhook event recorded",
 		"app", app.Name,
-		"branch", branch,
+		"source", source.String(),
+		"branch", pushEvent.Branch,
 		"matched", matched,
-		"commit", commitSHA,
+		"commit", pushEvent.After,
 	)
 
 	// If branch matches, trigger deployment
@@ -154,33 +132,3 @@ func (svc *Service) triggerDeployment(
 		_ = event.Save(deployCtx)
 	}()
 }
-
-// extractBranch extracts the branch name from a git ref.
-func extractBranch(ref string) string {
-	// refs/heads/main -> main
-	const prefix = "refs/heads/"
-
-	if len(ref) >= len(prefix) && ref[:len(prefix)] == prefix {
-		return ref[len(prefix):]
-	}
-
-	return ref
-}
-
-// extractCommitURL extracts the commit URL from the webhook payload.
-// Prefers the URL from the head commit, falls back to constructing from repo URL.
-func extractCommitURL(payload GiteaPushPayload) UnparsedURL {
-	// Try to find the URL from the head commit (matching After SHA)
-	for _, commit := range payload.Commits {
-		if commit.ID == payload.After && commit.URL != "" {
-			return commit.URL
-		}
-	}
-
-	// Fall back to constructing URL from repo HTML URL
-	if payload.Repository.HTMLURL != "" && payload.After != "" {
-		return UnparsedURL(payload.Repository.HTMLURL.String() + "/commit/" + payload.After)
-	}
-
-	return ""
-}

internal/service/webhook/webhook_test.go

@@ -3,6 +3,7 @@ package webhook_test
 import (
 	"context"
 	"encoding/json"
+	"net/http"
 	"os"
 	"path/filepath"
 	"testing"
@@ -102,44 +103,57 @@ func createTestApp(
 	return app
 }
 
+// TestDetectWebhookSource tests auto-detection of webhook source from HTTP headers.
+//
 //nolint:funlen // table-driven test with comprehensive test cases
-func TestExtractBranch(testingT *testing.T) {
+func TestDetectWebhookSource(testingT *testing.T) {
 	testingT.Parallel()
 
 	tests := []struct {
 		name     string
-		ref      string
+		headers  map[string]string
-		expected string
+		expected webhook.Source
 	}{
 		{
-			name:     "extracts main branch",
+			name:     "detects Gitea from X-Gitea-Event header",
-			ref:      "refs/heads/main",
+			headers:  map[string]string{"X-Gitea-Event": "push"},
-			expected: "main",
+			expected: webhook.SourceGitea,
 		},
 		{
-			name:     "extracts feature branch",
+			name:     "detects GitHub from X-GitHub-Event header",
-			ref:      "refs/heads/feature/new-feature",
+			headers:  map[string]string{"X-GitHub-Event": "push"},
-			expected: "feature/new-feature",
+			expected: webhook.SourceGitHub,
 		},
 		{
-			name:     "extracts develop branch",
+			name:     "detects GitLab from X-Gitlab-Event header",
-			ref:      "refs/heads/develop",
+			headers:  map[string]string{"X-Gitlab-Event": "Push Hook"},
-			expected: "develop",
+			expected: webhook.SourceGitLab,
 		},
 		{
-			name:     "returns raw ref if no prefix",
+			name:     "returns unknown when no recognized header",
-			ref:      "main",
+			headers:  map[string]string{"Content-Type": "application/json"},
-			expected: "main",
+			expected: webhook.SourceUnknown,
 		},
 		{
-			name:     "handles empty ref",
+			name:     "returns unknown for empty headers",
-			ref:      "",
+			headers:  map[string]string{},
-			expected: "",
+			expected: webhook.SourceUnknown,
 		},
 		{
-			name:     "handles partial prefix",
+			name: "Gitea takes precedence over GitHub",
-			ref:      "refs/heads/",
+			headers: map[string]string{
-			expected: "",
+				"X-Gitea-Event":  "push",
+				"X-GitHub-Event": "push",
+			},
+			expected: webhook.SourceGitea,
+		},
+		{
+			name: "GitHub takes precedence over GitLab",
+			headers: map[string]string{
+				"X-GitHub-Event": "push",
+				"X-Gitlab-Event": "Push Hook",
+			},
+			expected: webhook.SourceGitHub,
 		},
 	}
 
@@ -147,123 +161,375 @@ func TestExtractBranch(testingT *testing.T) {
 		testingT.Run(testCase.name, func(t *testing.T) {
 			t.Parallel()
 
-			// We test via HandleWebhook since extractBranch is not exported.
+			headers := http.Header{}
-			// The test verifies behavior indirectly through the webhook event's branch.
+			for key, value := range testCase.headers {
-			svc, dbInst, cleanup := setupTestService(t)
+				headers.Set(key, value)
-			defer cleanup()
+			}
 
-			app := createTestApp(t, dbInst, testCase.expected)
+			result := webhook.DetectWebhookSource(headers)
-
+			assert.Equal(t, testCase.expected, result)
-			payload := []byte(`{"ref": "` + testCase.ref + `"}`)
-
-			err := svc.HandleWebhook(context.Background(), app, "push", payload)
-			require.NoError(t, err)
-
-			// Allow async deployment goroutine to complete before test cleanup
-			time.Sleep(100 * time.Millisecond)
-
-			events, err := app.GetWebhookEvents(context.Background(), 10)
-			require.NoError(t, err)
-			require.Len(t, events, 1)
-
-			assert.Equal(t, testCase.expected, events[0].Branch)
 		})
 	}
 }
 
-func TestHandleWebhookMatchingBranch(t *testing.T) {
+// TestDetectEventType tests event type extraction from HTTP headers.
+func TestDetectEventType(testingT *testing.T) {
+	testingT.Parallel()
+
+	tests := []struct {
+		name     string
+		headers  map[string]string
+		source   webhook.Source
+		expected string
+	}{
+		{
+			name:     "extracts Gitea event type",
+			headers:  map[string]string{"X-Gitea-Event": "push"},
+			source:   webhook.SourceGitea,
+			expected: "push",
+		},
+		{
+			name:     "extracts GitHub event type",
+			headers:  map[string]string{"X-GitHub-Event": "push"},
+			source:   webhook.SourceGitHub,
+			expected: "push",
+		},
+		{
+			name:     "extracts GitLab event type",
+			headers:  map[string]string{"X-Gitlab-Event": "Push Hook"},
+			source:   webhook.SourceGitLab,
+			expected: "Push Hook",
+		},
+		{
+			name:     "returns push for unknown source",
+			headers:  map[string]string{},
+			source:   webhook.SourceUnknown,
+			expected: "push",
+		},
+		{
+			name:     "returns push when header missing for source",
+			headers:  map[string]string{},
+			source:   webhook.SourceGitea,
+			expected: "push",
+		},
+	}
+
+	for _, testCase := range tests {
+		testingT.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+
+			headers := http.Header{}
+			for key, value := range testCase.headers {
+				headers.Set(key, value)
+			}
+
+			result := webhook.DetectEventType(headers, testCase.source)
+			assert.Equal(t, testCase.expected, result)
+		})
+	}
+}
+
+// TestWebhookSourceString tests the String method on WebhookSource.
+func TestWebhookSourceString(t *testing.T) {
 	t.Parallel()
 
-	svc, dbInst, cleanup := setupTestService(t)
+	assert.Equal(t, "gitea", webhook.SourceGitea.String())
-	defer cleanup()
+	assert.Equal(t, "github", webhook.SourceGitHub.String())
+	assert.Equal(t, "gitlab", webhook.SourceGitLab.String())
+	assert.Equal(t, "unknown", webhook.SourceUnknown.String())
+}
 
-	app := createTestApp(t, dbInst, "main")
+// TestUnparsedURLString tests the String method on UnparsedURL.
+func TestUnparsedURLString(t *testing.T) {
+	t.Parallel()
+
+	u := webhook.UnparsedURL("https://example.com/test")
+	assert.Equal(t, "https://example.com/test", u.String())
+
+	empty := webhook.UnparsedURL("")
+	assert.Empty(t, empty.String())
+}
+
+// TestParsePushPayloadGitea tests parsing of Gitea push payloads.
+func TestParsePushPayloadGitea(t *testing.T) {
+	t.Parallel()
 
 	payload := []byte(`{
 		"ref": "refs/heads/main",
 		"before": "0000000000000000000000000000000000000000",
-		"after": "abc123def456",
+		"after": "abc123def456789",
+		"compare_url": "https://gitea.example.com/myorg/myrepo/compare/000...abc",
 		"repository": {
-			"full_name": "user/repo",
+			"full_name": "myorg/myrepo",
-			"clone_url": "https://gitea.example.com/user/repo.git",
+			"clone_url": "https://gitea.example.com/myorg/myrepo.git",
-			"ssh_url": "git@gitea.example.com:user/repo.git"
+			"ssh_url": "git@gitea.example.com:myorg/myrepo.git",
+			"html_url": "https://gitea.example.com/myorg/myrepo"
 		},
-		"pusher": {"username": "testuser", "email": "test@example.com"},
+		"pusher": {"username": "developer", "email": "dev@example.com"},
-		"commits": [{"id": "abc123def456", "message": "Test commit",
+		"commits": [
-			"author": {"name": "Test User", "email": "test@example.com"}}]
+			{
+				"id": "abc123def456789",
+				"url": "https://gitea.example.com/myorg/myrepo/commit/abc123def456789",
+				"message": "Fix bug",
+				"author": {"name": "Developer", "email": "dev@example.com"}
+			}
+		]
 	}`)
 
-	err := svc.HandleWebhook(context.Background(), app, "push", payload)
+	event, err := webhook.ParsePushPayload(webhook.SourceGitea, payload)
 	require.NoError(t, err)
 
-	// Allow async deployment goroutine to complete before test cleanup
+	assert.Equal(t, webhook.SourceGitea, event.Source)
-	time.Sleep(100 * time.Millisecond)
+	assert.Equal(t, "refs/heads/main", event.Ref)
-
-	events, err := app.GetWebhookEvents(context.Background(), 10)
-	require.NoError(t, err)
-	require.Len(t, events, 1)
-
-	event := events[0]
-	assert.Equal(t, "push", event.EventType)
 	assert.Equal(t, "main", event.Branch)
-	assert.True(t, event.Matched)
+	assert.Equal(t, "abc123def456789", event.After)
-	assert.Equal(t, "abc123def456", event.CommitSHA.String)
+	assert.Equal(t, "myorg/myrepo", event.RepoName)
+	assert.Equal(t, webhook.UnparsedURL("https://gitea.example.com/myorg/myrepo.git"), event.CloneURL)
+	assert.Equal(t, webhook.UnparsedURL("https://gitea.example.com/myorg/myrepo"), event.HTMLURL)
+	assert.Equal(t,
+		webhook.UnparsedURL("https://gitea.example.com/myorg/myrepo/commit/abc123def456789"),
+		event.CommitURL,
+	)
+	assert.Equal(t, "developer", event.Pusher)
 }
 
-func TestHandleWebhookNonMatchingBranch(t *testing.T) {
+// TestParsePushPayloadGitHub tests parsing of GitHub push payloads.
+func TestParsePushPayloadGitHub(t *testing.T) {
 	t.Parallel()
 
-	svc, dbInst, cleanup := setupTestService(t)
+	payload := []byte(`{
-	defer cleanup()
+		"ref": "refs/heads/main",
+		"before": "0000000000000000000000000000000000000000",
+		"after": "abc123def456789",
+		"compare": "https://github.com/myorg/myrepo/compare/000...abc",
+		"repository": {
+			"full_name": "myorg/myrepo",
+			"clone_url": "https://github.com/myorg/myrepo.git",
+			"ssh_url": "git@github.com:myorg/myrepo.git",
+			"html_url": "https://github.com/myorg/myrepo"
+		},
+		"pusher": {"name": "developer", "email": "dev@example.com"},
+		"head_commit": {
+			"id": "abc123def456789",
+			"url": "https://github.com/myorg/myrepo/commit/abc123def456789",
+			"message": "Fix bug"
+		},
+		"commits": [
+			{
+				"id": "abc123def456789",
+				"url": "https://github.com/myorg/myrepo/commit/abc123def456789",
+				"message": "Fix bug",
+				"author": {"name": "Developer", "email": "dev@example.com"}
+			}
+		]
+	}`)
 
-	app := createTestApp(t, dbInst, "main")
+	event, err := webhook.ParsePushPayload(webhook.SourceGitHub, payload)
-
-	payload := []byte(`{"ref": "refs/heads/develop", "after": "def789ghi012"}`)
-
-	err := svc.HandleWebhook(context.Background(), app, "push", payload)
 	require.NoError(t, err)
 
-	events, err := app.GetWebhookEvents(context.Background(), 10)
+	assert.Equal(t, webhook.SourceGitHub, event.Source)
-	require.NoError(t, err)
+	assert.Equal(t, "refs/heads/main", event.Ref)
-	require.Len(t, events, 1)
+	assert.Equal(t, "main", event.Branch)
-
+	assert.Equal(t, "abc123def456789", event.After)
-	assert.Equal(t, "develop", events[0].Branch)
+	assert.Equal(t, "myorg/myrepo", event.RepoName)
-	assert.False(t, events[0].Matched)
+	assert.Equal(t, webhook.UnparsedURL("https://github.com/myorg/myrepo.git"), event.CloneURL)
+	assert.Equal(t, webhook.UnparsedURL("https://github.com/myorg/myrepo"), event.HTMLURL)
+	assert.Equal(t,
+		webhook.UnparsedURL("https://github.com/myorg/myrepo/commit/abc123def456789"),
+		event.CommitURL,
+	)
+	assert.Equal(t, "developer", event.Pusher)
 }
 
-func TestHandleWebhookInvalidJSON(t *testing.T) {
+// TestParsePushPayloadGitLab tests parsing of GitLab push payloads.
+func TestParsePushPayloadGitLab(t *testing.T) {
 	t.Parallel()
 
-	svc, dbInst, cleanup := setupTestService(t)
+	payload := []byte(`{
-	defer cleanup()
+		"ref": "refs/heads/develop",
+		"before": "0000000000000000000000000000000000000000",
+		"after": "abc123def456789",
+		"user_name": "developer",
+		"user_email": "dev@example.com",
+		"project": {
+			"path_with_namespace": "mygroup/myproject",
+			"git_http_url": "https://gitlab.com/mygroup/myproject.git",
+			"git_ssh_url": "git@gitlab.com:mygroup/myproject.git",
+			"web_url": "https://gitlab.com/mygroup/myproject"
+		},
+		"commits": [
+			{
+				"id": "abc123def456789",
+				"url": "https://gitlab.com/mygroup/myproject/-/commit/abc123def456789",
+				"message": "Fix bug",
+				"author": {"name": "Developer", "email": "dev@example.com"}
+			}
+		]
+	}`)
 
-	app := createTestApp(t, dbInst, "main")
+	event, err := webhook.ParsePushPayload(webhook.SourceGitLab, payload)
-
-	err := svc.HandleWebhook(context.Background(), app, "push", []byte(`{invalid json}`))
 	require.NoError(t, err)
 
-	events, err := app.GetWebhookEvents(context.Background(), 10)
+	assert.Equal(t, webhook.SourceGitLab, event.Source)
-	require.NoError(t, err)
+	assert.Equal(t, "refs/heads/develop", event.Ref)
-	require.Len(t, events, 1)
+	assert.Equal(t, "develop", event.Branch)
+	assert.Equal(t, "abc123def456789", event.After)
+	assert.Equal(t, "mygroup/myproject", event.RepoName)
+	assert.Equal(t, webhook.UnparsedURL("https://gitlab.com/mygroup/myproject.git"), event.CloneURL)
+	assert.Equal(t, webhook.UnparsedURL("https://gitlab.com/mygroup/myproject"), event.HTMLURL)
+	assert.Equal(t,
+		webhook.UnparsedURL("https://gitlab.com/mygroup/myproject/-/commit/abc123def456789"),
+		event.CommitURL,
+	)
+	assert.Equal(t, "developer", event.Pusher)
 }
 
-func TestHandleWebhookEmptyPayload(t *testing.T) {
+// TestParsePushPayloadUnknownFallsBackToGitea tests that unknown source uses Gitea parser.
+func TestParsePushPayloadUnknownFallsBackToGitea(t *testing.T) {
 	t.Parallel()
 
-	svc, dbInst, cleanup := setupTestService(t)
+	payload := []byte(`{
-	defer cleanup()
+		"ref": "refs/heads/main",
+		"after": "abc123",
+		"repository": {"full_name": "user/repo"},
+		"pusher": {"username": "user"}
+	}`)
 
-	app := createTestApp(t, dbInst, "main")
+	event, err := webhook.ParsePushPayload(webhook.SourceUnknown, payload)
-
-	err := svc.HandleWebhook(context.Background(), app, "push", []byte(`{}`))
 	require.NoError(t, err)
 
-	events, err := app.GetWebhookEvents(context.Background(), 10)
+	assert.Equal(t, webhook.SourceGitea, event.Source)
-	require.NoError(t, err)
+	assert.Equal(t, "main", event.Branch)
-	require.Len(t, events, 1)
+	assert.Equal(t, "abc123", event.After)
-	assert.False(t, events[0].Matched)
 }
 
+// TestParsePushPayloadInvalidJSON tests that invalid JSON returns an error.
+func TestParsePushPayloadInvalidJSON(t *testing.T) {
+	t.Parallel()
+
+	sources := []webhook.Source{
+		webhook.SourceGitea,
+		webhook.SourceGitHub,
+		webhook.SourceGitLab,
+	}
+
+	for _, source := range sources {
+		t.Run(source.String(), func(t *testing.T) {
+			t.Parallel()
+
+			_, err := webhook.ParsePushPayload(source, []byte(`{invalid json}`))
+			require.Error(t, err)
+		})
+	}
+}
+
+// TestParsePushPayloadEmptyPayload tests parsing of empty JSON objects.
+func TestParsePushPayloadEmptyPayload(t *testing.T) {
+	t.Parallel()
+
+	sources := []webhook.Source{
+		webhook.SourceGitea,
+		webhook.SourceGitHub,
+		webhook.SourceGitLab,
+	}
+
+	for _, source := range sources {
+		t.Run(source.String(), func(t *testing.T) {
+			t.Parallel()
+
+			event, err := webhook.ParsePushPayload(source, []byte(`{}`))
+			require.NoError(t, err)
+
+			assert.Empty(t, event.Branch)
+			assert.Empty(t, event.After)
+		})
+	}
+}
+
+// TestGitHubCommitURLFallback tests commit URL extraction fallback paths for GitHub.
+func TestGitHubCommitURLFallback(t *testing.T) {
+	t.Parallel()
+
+	t.Run("uses head_commit URL when available", func(t *testing.T) {
+		t.Parallel()
+
+		payload := []byte(`{
+			"ref": "refs/heads/main",
+			"after": "abc123",
+			"head_commit": {"id": "abc123", "url": "https://github.com/u/r/commit/abc123"},
+			"repository": {"html_url": "https://github.com/u/r"}
+		}`)
+
+		event, err := webhook.ParsePushPayload(webhook.SourceGitHub, payload)
+		require.NoError(t, err)
+		assert.Equal(t, webhook.UnparsedURL("https://github.com/u/r/commit/abc123"), event.CommitURL)
+	})
+
+	t.Run("falls back to commits list", func(t *testing.T) {
+		t.Parallel()
+
+		payload := []byte(`{
+			"ref": "refs/heads/main",
+			"after": "abc123",
+			"commits": [{"id": "abc123", "url": "https://github.com/u/r/commit/abc123"}],
+			"repository": {"html_url": "https://github.com/u/r"}
+		}`)
+
+		event, err := webhook.ParsePushPayload(webhook.SourceGitHub, payload)
+		require.NoError(t, err)
+		assert.Equal(t, webhook.UnparsedURL("https://github.com/u/r/commit/abc123"), event.CommitURL)
+	})
+
+	t.Run("constructs URL from repo HTML URL", func(t *testing.T) {
+		t.Parallel()
+
+		payload := []byte(`{
+			"ref": "refs/heads/main",
+			"after": "abc123",
+			"repository": {"html_url": "https://github.com/u/r"}
+		}`)
+
+		event, err := webhook.ParsePushPayload(webhook.SourceGitHub, payload)
+		require.NoError(t, err)
+		assert.Equal(t, webhook.UnparsedURL("https://github.com/u/r/commit/abc123"), event.CommitURL)
+	})
+}
+
+// TestGitLabCommitURLFallback tests commit URL extraction fallback paths for GitLab.
+func TestGitLabCommitURLFallback(t *testing.T) {
+	t.Parallel()
+
+	t.Run("uses commit URL from list", func(t *testing.T) {
+		t.Parallel()
+
+		payload := []byte(`{
+			"ref": "refs/heads/main",
+			"after": "abc123",
+			"project": {"web_url": "https://gitlab.com/g/p"},
+			"commits": [{"id": "abc123", "url": "https://gitlab.com/g/p/-/commit/abc123"}]
+		}`)
+
+		event, err := webhook.ParsePushPayload(webhook.SourceGitLab, payload)
+		require.NoError(t, err)
+		assert.Equal(t, webhook.UnparsedURL("https://gitlab.com/g/p/-/commit/abc123"), event.CommitURL)
+	})
+
+	t.Run("constructs URL from project web URL", func(t *testing.T) {
+		t.Parallel()
+
+		payload := []byte(`{
+			"ref": "refs/heads/main",
+			"after": "abc123",
+			"project": {"web_url": "https://gitlab.com/g/p"}
+		}`)
+
+		event, err := webhook.ParsePushPayload(webhook.SourceGitLab, payload)
+		require.NoError(t, err)
+		assert.Equal(t, webhook.UnparsedURL("https://gitlab.com/g/p/-/commit/abc123"), event.CommitURL)
+	})
+}
+
+// TestGiteaPushPayloadParsing tests direct deserialization of the Gitea payload struct.
 func TestGiteaPushPayloadParsing(testingT *testing.T) {
 	testingT.Parallel()
 
@@ -322,6 +588,354 @@ func TestGiteaPushPayloadParsing(testingT *testing.T) {
 	})
 }
 
+// TestGitHubPushPayloadParsing tests direct deserialization of the GitHub payload struct.
+func TestGitHubPushPayloadParsing(t *testing.T) {
+	t.Parallel()
+
+	payload := []byte(`{
+		"ref": "refs/heads/main",
+		"before": "0000000000",
+		"after": "abc123",
+		"compare": "https://github.com/o/r/compare/000...abc",
+		"repository": {
+			"full_name": "o/r",
+			"clone_url": "https://github.com/o/r.git",
+			"ssh_url": "git@github.com:o/r.git",
+			"html_url": "https://github.com/o/r"
+		},
+		"pusher": {"name": "octocat", "email": "octocat@github.com"},
+		"head_commit": {
+			"id": "abc123",
+			"url": "https://github.com/o/r/commit/abc123",
+			"message": "Update README"
+		},
+		"commits": [
+			{
+				"id": "abc123",
+				"url": "https://github.com/o/r/commit/abc123",
+				"message": "Update README",
+				"author": {"name": "Octocat", "email": "octocat@github.com"}
+			}
+		]
+	}`)
+
+	var p webhook.GitHubPushPayload
+
+	err := json.Unmarshal(payload, &p)
+	require.NoError(t, err)
+
+	assert.Equal(t, "refs/heads/main", p.Ref)
+	assert.Equal(t, "abc123", p.After)
+	assert.Equal(t, "o/r", p.Repository.FullName)
+	assert.Equal(t, "octocat", p.Pusher.Name)
+	assert.NotNil(t, p.HeadCommit)
+	assert.Equal(t, "abc123", p.HeadCommit.ID)
+	assert.Len(t, p.Commits, 1)
+}
+
+// TestGitLabPushPayloadParsing tests direct deserialization of the GitLab payload struct.
+func TestGitLabPushPayloadParsing(t *testing.T) {
+	t.Parallel()
+
+	payload := []byte(`{
+		"ref": "refs/heads/main",
+		"before": "0000000000",
+		"after": "abc123",
+		"user_name": "gitlab-user",
+		"user_email": "user@gitlab.com",
+		"project": {
+			"path_with_namespace": "group/project",
+			"git_http_url": "https://gitlab.com/group/project.git",
+			"git_ssh_url": "git@gitlab.com:group/project.git",
+			"web_url": "https://gitlab.com/group/project"
+		},
+		"commits": [
+			{
+				"id": "abc123",
+				"url": "https://gitlab.com/group/project/-/commit/abc123",
+				"message": "Fix pipeline",
+				"author": {"name": "GitLab User", "email": "user@gitlab.com"}
+			}
+		]
+	}`)
+
+	var p webhook.GitLabPushPayload
+
+	err := json.Unmarshal(payload, &p)
+	require.NoError(t, err)
+
+	assert.Equal(t, "refs/heads/main", p.Ref)
+	assert.Equal(t, "abc123", p.After)
+	assert.Equal(t, "group/project", p.Project.PathWithNamespace)
+	assert.Equal(t, "gitlab-user", p.UserName)
+	assert.Len(t, p.Commits, 1)
+}
+
+// TestExtractBranch tests branch extraction via HandleWebhook integration (extractBranch is unexported).
+//
+//nolint:funlen // table-driven test with comprehensive test cases
+func TestExtractBranch(testingT *testing.T) {
+	testingT.Parallel()
+
+	tests := []struct {
+		name     string
+		ref      string
+		expected string
+	}{
+		{
+			name:     "extracts main branch",
+			ref:      "refs/heads/main",
+			expected: "main",
+		},
+		{
+			name:     "extracts feature branch",
+			ref:      "refs/heads/feature/new-feature",
+			expected: "feature/new-feature",
+		},
+		{
+			name:     "extracts develop branch",
+			ref:      "refs/heads/develop",
+			expected: "develop",
+		},
+		{
+			name:     "returns raw ref if no prefix",
+			ref:      "main",
+			expected: "main",
+		},
+		{
+			name:     "handles empty ref",
+			ref:      "",
+			expected: "",
+		},
+		{
+			name:     "handles partial prefix",
+			ref:      "refs/heads/",
+			expected: "",
+		},
+	}
+
+	for _, testCase := range tests {
+		testingT.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+
+			// We test via HandleWebhook since extractBranch is not exported.
+			// The test verifies behavior indirectly through the webhook event's branch.
+			svc, dbInst, cleanup := setupTestService(t)
+			defer cleanup()
+
+			app := createTestApp(t, dbInst, testCase.expected)
+
+			payload := []byte(`{"ref": "` + testCase.ref + `"}`)
+
+			err := svc.HandleWebhook(
+				context.Background(), app, webhook.SourceGitea, "push", payload,
+			)
+			require.NoError(t, err)
+
+			// Allow async deployment goroutine to complete before test cleanup
+			time.Sleep(100 * time.Millisecond)
+
+			events, err := app.GetWebhookEvents(context.Background(), 10)
+			require.NoError(t, err)
+			require.Len(t, events, 1)
+
+			assert.Equal(t, testCase.expected, events[0].Branch)
+		})
+	}
+}
+
+func TestHandleWebhookMatchingBranch(t *testing.T) {
+	t.Parallel()
+
+	svc, dbInst, cleanup := setupTestService(t)
+	defer cleanup()
+
+	app := createTestApp(t, dbInst, "main")
+
+	payload := []byte(`{
+		"ref": "refs/heads/main",
+		"before": "0000000000000000000000000000000000000000",
+		"after": "abc123def456",
+		"repository": {
+			"full_name": "user/repo",
+			"clone_url": "https://gitea.example.com/user/repo.git",
+			"ssh_url": "git@gitea.example.com:user/repo.git"
+		},
+		"pusher": {"username": "testuser", "email": "test@example.com"},
+		"commits": [{"id": "abc123def456", "message": "Test commit",
+			"author": {"name": "Test User", "email": "test@example.com"}}]
+	}`)
+
+	err := svc.HandleWebhook(
+		context.Background(), app, webhook.SourceGitea, "push", payload,
+	)
+	require.NoError(t, err)
+
+	// Allow async deployment goroutine to complete before test cleanup
+	time.Sleep(100 * time.Millisecond)
+
+	events, err := app.GetWebhookEvents(context.Background(), 10)
+	require.NoError(t, err)
+	require.Len(t, events, 1)
+
+	event := events[0]
+	assert.Equal(t, "push", event.EventType)
+	assert.Equal(t, "main", event.Branch)
+	assert.True(t, event.Matched)
+	assert.Equal(t, "abc123def456", event.CommitSHA.String)
+}
+
+func TestHandleWebhookNonMatchingBranch(t *testing.T) {
+	t.Parallel()
+
+	svc, dbInst, cleanup := setupTestService(t)
+	defer cleanup()
+
+	app := createTestApp(t, dbInst, "main")
+
+	payload := []byte(`{"ref": "refs/heads/develop", "after": "def789ghi012"}`)
+
+	err := svc.HandleWebhook(
+		context.Background(), app, webhook.SourceGitea, "push", payload,
+	)
+	require.NoError(t, err)
+
+	events, err := app.GetWebhookEvents(context.Background(), 10)
+	require.NoError(t, err)
+	require.Len(t, events, 1)
+
+	assert.Equal(t, "develop", events[0].Branch)
+	assert.False(t, events[0].Matched)
+}
+
+func TestHandleWebhookInvalidJSON(t *testing.T) {
+	t.Parallel()
+
+	svc, dbInst, cleanup := setupTestService(t)
+	defer cleanup()
+
+	app := createTestApp(t, dbInst, "main")
+
+	err := svc.HandleWebhook(
+		context.Background(), app, webhook.SourceGitea, "push", []byte(`{invalid json}`),
+	)
+	require.NoError(t, err)
+
+	events, err := app.GetWebhookEvents(context.Background(), 10)
+	require.NoError(t, err)
+	require.Len(t, events, 1)
+}
+
+func TestHandleWebhookEmptyPayload(t *testing.T) {
+	t.Parallel()
+
+	svc, dbInst, cleanup := setupTestService(t)
+	defer cleanup()
+
+	app := createTestApp(t, dbInst, "main")
+
+	err := svc.HandleWebhook(
+		context.Background(), app, webhook.SourceGitea, "push", []byte(`{}`),
+	)
+	require.NoError(t, err)
+
+	events, err := app.GetWebhookEvents(context.Background(), 10)
+	require.NoError(t, err)
+	require.Len(t, events, 1)
+	assert.False(t, events[0].Matched)
+}
+
+// TestHandleWebhookGitHubSource tests HandleWebhook with a GitHub push payload.
+func TestHandleWebhookGitHubSource(t *testing.T) {
+	t.Parallel()
+
+	svc, dbInst, cleanup := setupTestService(t)
+	defer cleanup()
+
+	app := createTestApp(t, dbInst, "main")
+
+	payload := []byte(`{
+		"ref": "refs/heads/main",
+		"after": "github123",
+		"repository": {
+			"full_name": "org/repo",
+			"clone_url": "https://github.com/org/repo.git",
+			"html_url": "https://github.com/org/repo"
+		},
+		"pusher": {"name": "octocat", "email": "octocat@github.com"},
+		"head_commit": {
+			"id": "github123",
+			"url": "https://github.com/org/repo/commit/github123",
+			"message": "Update feature"
+		}
+	}`)
+
+	err := svc.HandleWebhook(
+		context.Background(), app, webhook.SourceGitHub, "push", payload,
+	)
+	require.NoError(t, err)
+
+	// Allow async deployment goroutine to complete before test cleanup
+	time.Sleep(100 * time.Millisecond)
+
+	events, err := app.GetWebhookEvents(context.Background(), 10)
+	require.NoError(t, err)
+	require.Len(t, events, 1)
+
+	event := events[0]
+	assert.Equal(t, "main", event.Branch)
+	assert.True(t, event.Matched)
+	assert.Equal(t, "github123", event.CommitSHA.String)
+	assert.Equal(t, "https://github.com/org/repo/commit/github123", event.CommitURL.String)
+}
+
+// TestHandleWebhookGitLabSource tests HandleWebhook with a GitLab push payload.
+func TestHandleWebhookGitLabSource(t *testing.T) {
+	t.Parallel()
+
+	svc, dbInst, cleanup := setupTestService(t)
+	defer cleanup()
+
+	app := createTestApp(t, dbInst, "main")
+
+	payload := []byte(`{
+		"ref": "refs/heads/main",
+		"after": "gitlab456",
+		"user_name": "gitlab-dev",
+		"user_email": "dev@gitlab.com",
+		"project": {
+			"path_with_namespace": "group/project",
+			"git_http_url": "https://gitlab.com/group/project.git",
+			"web_url": "https://gitlab.com/group/project"
+		},
+		"commits": [
+			{
+				"id": "gitlab456",
+				"url": "https://gitlab.com/group/project/-/commit/gitlab456",
+				"message": "Deploy fix"
+			}
+		]
+	}`)
+
+	err := svc.HandleWebhook(
+		context.Background(), app, webhook.SourceGitLab, "push", payload,
+	)
+	require.NoError(t, err)
+
+	// Allow async deployment goroutine to complete before test cleanup
+	time.Sleep(100 * time.Millisecond)
+
+	events, err := app.GetWebhookEvents(context.Background(), 10)
+	require.NoError(t, err)
+	require.Len(t, events, 1)
+
+	event := events[0]
+	assert.Equal(t, "main", event.Branch)
+	assert.True(t, event.Matched)
+	assert.Equal(t, "gitlab456", event.CommitSHA.String)
+	assert.Equal(t, "https://gitlab.com/group/project/-/commit/gitlab456", event.CommitURL.String)
+}
+
 // TestSetupTestService verifies the test helper creates a working test service.
 func TestSetupTestService(testingT *testing.T) {
 	testingT.Parallel()
@@ -341,3 +955,25 @@ func TestSetupTestService(testingT *testing.T) {
 		require.NoError(t, err)
 	})
 }
+
+// TestPushEventConstruction tests that PushEvent can be constructed directly.
+func TestPushEventConstruction(t *testing.T) {
+	t.Parallel()
+
+	event := webhook.PushEvent{
+		Source:    webhook.SourceGitHub,
+		Ref:       "refs/heads/main",
+		Before:    "000",
+		After:     "abc",
+		Branch:    "main",
+		RepoName:  "org/repo",
+		CloneURL:  webhook.UnparsedURL("https://github.com/org/repo.git"),
+		HTMLURL:   webhook.UnparsedURL("https://github.com/org/repo"),
+		CommitURL: webhook.UnparsedURL("https://github.com/org/repo/commit/abc"),
+		Pusher:    "user",
+	}
+
+	assert.Equal(t, "main", event.Branch)
+	assert.Equal(t, webhook.SourceGitHub, event.Source)
+	assert.Equal(t, "abc", event.After)
+}