chore(build): replace the webhook events generator with a test that pins the list to @octokit/openapi-webhooks

[Vivswan]

Before / After

Before: src/sections/webhooks/events.ts was a generated file. A generator script rendered it from the @octokit/openapi-webhooks descriptor, bun run build:events ran it, build:check gated its drift, and auto-fix.yml committed it back on Dependabot bumps.

After: the list is a committed source file pinned by a test. test/sections/webhooks-events.test.ts recomputes the repository events from the package and fails with the names to add or drop when the list is stale. The generator, its unit test, the build:events script, the generated-output row, and the auto-fix branch are gone.

A Dependabot bump of @octokit/openapi-webhooks that adds or drops a repository event now fails CI on the bump PR until someone edits the list. Nothing rewrites the file.

How

• The package ships only the eight full descriptors (about 4.8 MB each) and no runtime list or type union scoped to repository webhooks, so a module-load derivation was ruled out by measurement:

Bundle	lib/index.js bytes
before this change	4774340
after this change	4774340
with the descriptor imported into src/	9374832

• The derivation moved from the generator into the test. A descriptor entry missing a field it reads is reported as a value (a missing list the test asserts empty), not skipped and not thrown, so the list can never silently shorten.
• lib/settings.schema.json is byte-identical: the list did not change with the current package version.
• auto-fix.yml loses every mention of the events file; test/scripts/auto-fix-allowlist.test.ts pins its allowlists to the generated-output table and passes with the row removed.
• The upgrade guide's one sentence that called the list "generated" now says "pinned".

Proof

• bun run typecheck, bun run knip, bun run lint, bun run build:check: green, no regeneration.
• bun test test/sections/webhooks-events.test.ts test/sections/webhooks-schema.test.ts test/sections/docs-registry.test.ts test/scripts/generated.test.ts test/scripts/auto-fix-allowlist.test.ts --timeout 120000: 43 pass, 0 fail.
• bun run test:e2e --sections webhooks: 13/13 passed.
• Negative control: removing "gollum" from the list makes the new test fail with a unified diff naming that one line; restoring it passes.

Line accounting by kind

Kind	Files	Added	Deleted
Generator scripts	.github/scripts/gen-webhook-events.ts, .github/scripts/generated.ts	1	131
Workflow	.github/workflows/auto-fix.yml	8	16
Source	src/sections/webhooks/events.ts (header only, list unchanged)	5	4
Tests	test/sections/webhooks-events.test.ts (new), test/scripts/gen-webhook-events.test.ts (deleted), test/scripts/generated.test.ts	141	68
Package manifest	package.json	1	2
Docs	docs/upgrading/v2-to-v3.md	1	1
Total		157	222

Reviewer note

The list in events.ts is unchanged byte for byte; only its header comment moved from "generated, do not edit" to "committed, pinned by the test". The path a reviewer should read is the new test, then the auto-fix workflow diff.
Committed-plus-test beat a runtime import because the package ships no small list: importing the 4.8 MB descriptor into src/ takes lib/index.js from 4774340 to 9374832 bytes, and no sibling package (@octokit/webhooks-types, @octokit/webhooks) offers a repository-scoped runtime list.

BEGIN_COMMIT_OVERRIDE
chore(build): replace the webhook events generator with a test that pins the list to @octokit/openapi-webhooks

The repository webhook event list stays committed in src/sections/webhooks/events.ts and stops being a generated artifact.
A new test recomputes the list from the package's api.github.com.json descriptor and fails naming the added and dropped events when a bump moves it.
The generator, its build:events script, its row in the generated-output table, and its branch in auto-fix.yml go away, so a Dependabot bump of the package now fails loudly until the list is edited.
The descriptor is not imported into src/ because bundling it grows lib/index.js from 4774340 to 9374832 bytes.
END_COMMIT_OVERRIDE

[github-actions]

File size check

0 over a hard cap (fails), 31 warning(s).

File	Size	Tier	Cap
.github/scripts/release-pipeline.ts:6	156 chars	warn	150
.github/scripts/release-pipeline.ts:477	151 chars	warn	150
.github/scripts/release-pipeline.ts:1447	153 chars	warn	150
.github/scripts/release-pipeline.ts:1	30 comment lines (header)	warn	25
.github/scripts/release-pipeline.ts:473	14 comment lines	warn	10
.github/workflows/post-green.yml:27	153 chars	warn	150
.github/workflows/post-green.yml:140	16 comment lines	warn	10
docs/upgrading/v2-to-v3.md	1257 lines	warn	1040
src/engine/layers.ts:217	157 chars	warn	150
src/flows/settings-write.ts:142	159 chars	warn	150
src/flows/settings-write.ts:30	11 comment lines	warn	10
src/flows/snapshot.ts:189	13 comment lines	warn	10
src/github/secret-scan.ts:42	11 comment lines	warn	10
src/schema.ts:186	153 chars	warn	150
src/schema.ts:197	176 chars	warn	150
src/sections/contract/errors.ts:14	14 comment lines	warn	10
src/sections/contract/module.ts:963	185 chars	warn	150
src/sections/contract/module.ts:627	12 comment lines	warn	10
src/sections/contract/module.ts:897	12 comment lines	warn	10
src/sections/secret_scanning_custom_patterns/compilable-form.ts:382	161 chars	warn	150
src/sections/shared/roles.ts:43	13 comment lines	warn	10
src/types.ts:16	156 chars	warn	150
test/docs/guides.test.ts:451	155 chars	warn	150
test/e2e/generators.ts	2633 lines	warn	2560
test/e2e/generators.ts:1703	166 chars	warn	150
test/e2e/generators.ts:1857	161 chars	warn	150
test/e2e/generators.ts:1666	12 comment lines	warn	10
test/engine/execute.test.ts:617	152 chars	warn	150
test/flows/merge-parity.test.ts:63	164 chars	warn	150
test/scripts/auto-fix-allowlist.test.ts:8	12 comment lines	warn	10
test/scripts/changed-sections.test.ts:416	154 chars	warn	150

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

[Copilot]

Copilot review overview

🟢 Approval recommended

The new test preserves drift detection while the generator and all related automation references are consistently removed.

Review effort: Balanced
Findings: None

What changed in this PR

Replaces webhook event generation with a CI test that pins the committed list to @octokit/openapi-webhooks.

Changes:

• Adds descriptor-based drift and derivation tests.
• Removes the generator, build script, and generated-file registration.
• Removes webhook-event regeneration from the auto-fix workflow.

File	Description
test/​sections/​webhooks-events.test.ts	Adds event-list pinning tests.
test/​scripts/​generated.test.ts	Removes events from generated files.
test/​scripts/​gen-webhook-events.test.ts	Removes generator tests.
src/​sections/​webhooks/​events.ts	Documents the committed-list workflow.
package.json	Removes build:events.
docs/​upgrading/​v2-to-v3.md	Describes the list as pinned.
.github/​workflows/​auto-fix.yml	Removes event regeneration and allowlisting.
.github/​scripts/​generated.ts	Removes the generated-output entry.
.github/​scripts/​gen-webhook-events.ts	Deletes the obsolete generator.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The new test preserves drift detection while the generator and all associated references are removed consistently.

Review effort: Balanced
Findings: None