chore(build): replace the webhook events generator with a test that pins the list to @octokit/openapi-webhooks

.github/scripts/generated.ts

@@ -7,7 +7,6 @@ import { join } from "node:path";
 import { GENERATED_REGIONS } from "./gen-action-docs.js";
 import { COVERAGE_PATH, PAGE_REGIONS } from "./gen-docs.js";
 import { INDEX_PATH } from "./gen-gaps-index.js";
-import { EVENTS_PATH } from "./gen-webhook-events.js";
 
 const ROOT = join(import.meta.dir, "..", "..");
 
@@ -24,10 +23,8 @@ function regions(generator: string, paths: readonly string[]): GeneratedOutput[]
   return paths.map((path) => ({ path, generator, kind: "regions" }));
 }
 
-/** A page two generators write into (docs/reference/inputs.md) has one row per generator. Table order is run order:
- * the webhook events feed the schema, so they render first, or a package bump would leave the two inconsistent for a run. */
+/** A page two generators write into (docs/reference/inputs.md) has one row per generator. Table order is run order. */
 export const GENERATED_OUTPUTS: readonly GeneratedOutput[] = [
-  { path: EVENTS_PATH, generator: ".github/scripts/gen-webhook-events.ts", kind: "file" },
   {
     path: "lib/settings.schema.json",
     generator: ".github/scripts/gen-settings-schema.ts",

.github/workflows/auto-fix.yml

@@ -1,7 +1,5 @@
 # The commit-back fixes a same-repo PR can need, pushed to its branch; an already-clean tree gets no commit. A PR
 # with unrelated type errors fails the build job by design: the graduation script refuses to half-fix a red build.
-#   src/sections/webhooks/events.ts              -> build:events (a Dependabot @octokit/openapi-webhooks bump changes the event list on a
-#                                                   branch nobody builds)
 #   lib/settings.schema.json                     -> build:schema (a Dependabot generator bump changes its bytes on a branch nobody builds)
 #   README, action.yml, docs/ regions           -> build:docs, build:action-docs
 #   src/upstream-gaps/                           -> graduate-upstream-gaps.ts retires the gap files @octokit/types caught up with;
@@ -43,7 +41,6 @@ on:
       - "bun.lock"
       - "tsconfig.json"
       - ".bun-version"
-      - ".github/scripts/gen-webhook-events.ts"
       - ".github/scripts/gen-settings-schema.ts"
       - ".github/scripts/graduate-upstream-gaps.ts"
       - ".github/scripts/gen-gaps-index.ts"
@@ -85,27 +82,26 @@ jobs:
       - name: Graduate upstream gaps octokit now ships
         shell: bash
         run: bun .github/scripts/graduate-upstream-gaps.ts
-      - name: Regenerate the webhook events, schema, docs, and gaps index and stage the fix patch
+      - name: Regenerate the schema, docs, and gaps index and stage the fix patch
         id: rebuild
         shell: bash
         run: |
-          # One line per generator, in .github/scripts/generated.ts table order: the schema enum reads the events
-          # file, so the events render first. test/scripts/auto-fix-allowlist.test.ts pins the list and the order.
-          bun run build:events
+          # One line per generator, in .github/scripts/generated.ts table order; test/scripts/auto-fix-allowlist.test.ts
+          # pins the list and the order.
           bun run build:schema
           bun run build:docs
           bun run build:action-docs
           bun .github/scripts/gen-gaps-index.ts
           # Anything the earlier steps left staged is not this workflow's fix: start from an empty index so the
           # patch holds exactly the allowed paths.
           git reset -q
-          git add -A -- src/sections/webhooks/events.ts lib/settings.schema.json README.md action.yml \
+          git add -A -- lib/settings.schema.json README.md action.yml \
             docs/reference/coverage.md docs/reference/undeclared-policy.md docs/reference/permissions.md \
             docs/operate/check-mode.md docs/reference/sections.md docs/reference/inputs.md \
             docs/reference/architecture.md docs/start/getting-started.md src/upstream-gaps/
           git diff --cached --binary > "$RUNNER_TEMP/autofix.patch"
           if [ ! -s "$RUNNER_TEMP/autofix.patch" ]; then
-            echo "webhook events, schema, docs, and upstream gaps already fresh"
+            echo "schema, docs, and upstream gaps already fresh"
             echo "changed=false" >> "$GITHUB_OUTPUT"
             echo "pruned=false" >> "$GITHUB_OUTPUT"
           else
@@ -172,13 +168,12 @@ jobs:
           # of a protected path cannot hide behind an allowed destination.
           while IFS= read -r -d '' path; do
             case "$path" in
-              src/sections/webhooks/events.ts | lib/settings.schema.json | README.md | action.yml | \
+              lib/settings.schema.json | README.md | action.yml | \
               docs/reference/coverage.md | docs/reference/undeclared-policy.md | docs/reference/permissions.md | \
               docs/operate/check-mode.md | docs/reference/sections.md | docs/reference/inputs.md | \
               docs/reference/architecture.md | docs/start/getting-started.md | src/upstream-gaps/*) ;;
               *)
-                echo "::error::the fix patch staged '$path', outside src/sections/webhooks/events.ts," \
-                  "lib/settings.schema.json, the generated docs" \
+                echo "::error::the fix patch staged '$path', outside lib/settings.schema.json, the generated docs" \
                   "(README.md, action.yml, docs/reference/coverage.md, docs/reference/undeclared-policy.md," \
                   "docs/reference/permissions.md, docs/operate/check-mode.md, docs/reference/sections.md," \
                   "docs/reference/inputs.md, docs/reference/architecture.md, docs/start/getting-started.md)," \
@@ -197,10 +192,7 @@ jobs:
           if ! git diff --cached --quiet -- lib/settings.schema.json; then
             subject="build: regenerate settings schema"
           fi
-          if ! git diff --cached --quiet -- src/sections/webhooks/events.ts; then
-            subject="build: regenerate webhook events and settings schema"
-          fi
-          if git diff --cached --quiet -- src/sections/webhooks/events.ts lib/settings.schema.json src/upstream-gaps/; then
+          if git diff --cached --quiet -- lib/settings.schema.json src/upstream-gaps/; then
             subject="docs: regenerate generated docs"
           fi
           if [ "$PRUNED" = "true" ]; then

docs/upgrading/v2-to-v3.md

@@ -1020,7 +1020,7 @@ v3   webhooks[0].config.url: "hooks.example.com/ci" is not an absolute URL (the
      webhooks[0].events[1]: "pushes" is not an event GitHub delivers to repository webhooks ("*" means every event); the accepted names are GitHub's list at https://docs.github.com/webhooks/webhook-events-and-payloads, read from @octokit/openapi-webhooks, so an event GitHub added since arrives in the release that bumps that package
 ```
 
-Fix: an absolute URL, `json` or `form`, `"0"` or `"1"`, and event names from GitHub's repository list. The list is generated from `@octokit/openapi-webhooks`, so an event GitHub adds later is refused until the release that bumps that package.
+Fix: an absolute URL, `json` or `form`, `"0"` or `"1"`, and event names from GitHub's repository list. The list is pinned to `@octokit/openapi-webhooks`, so an event GitHub adds later is refused until the release that bumps that package.
 
 ## 48. Secret scanning patterns must compile
 

package.json

@@ -51,10 +51,9 @@
     "test:artifacts": "bun .github/scripts/trim-openapi.ts --when-stale && bun .github/scripts/fetch-graphql-schema.ts --when-stale",
     "test:e2e": "bun run test:artifacts && bun test/e2e/run.ts",
     "fuzz": "bun run test:artifacts && bun test/e2e/fuzz.ts",
-    "build": "bun run build:events && bun run build:bundle && bun run build:lib && bun run build:schema && bun run build:docs && bun run build:action-docs",
+    "build": "bun run build:bundle && bun run build:lib && bun run build:schema && bun run build:docs && bun run build:action-docs",
     "build:bundle": "bun build src/main.ts --target=node --outfile lib/index.js",
     "build:lib": "bun x tsdown",
-    "build:events": "bun .github/scripts/gen-webhook-events.ts",
     "build:schema": "bun .github/scripts/gen-settings-schema.ts",
     "build:docs": "bun run test:artifacts && bun .github/scripts/gen-docs.ts",
     "build:action-docs": "bun .github/scripts/gen-action-docs.ts",

src/sections/webhooks/events.ts

@@ -1,8 +1,9 @@
 /**
- * GENERATED by gen-webhook-events.ts - do not edit. The events GitHub delivers to repository webhooks, from
- * GitHub's webhooks OpenAPI description as @octokit/openapi-webhooks ships it (generated/api.github.com.json):
- * every webhook whose supported-webhook-types names "repository", spelled as the wire event name. Regenerate
- * with `bun .github/scripts/gen-webhook-events.ts` after a package bump.
+ * The events GitHub delivers to repository webhooks, spelled as the wire event name: every webhook in GitHub's
+ * webhooks OpenAPI description, as @octokit/openapi-webhooks ships it (generated/api.github.com.json), whose
+ * supported-webhook-types names "repository". The list is committed, not imported: bundling the descriptor would
+ * double lib/index.js. test/sections/webhooks-events.test.ts recomputes it from the package and fails with the
+ * names added and dropped when a bump moves the list; the fix is to edit this file to match.
  */
 
 /** GitHub's reference page for the events, the externalDocs url the descriptor's entries point at. */

test/scripts/generated.test.ts

@@ -14,11 +14,7 @@ import { withTempDir } from "../temp-dir.js";
 /** Only a file type with a marker syntax carries a region; a marker string anywhere else is test or script text. */
 const regionFile = (path: string): boolean => extname(path) in SYNTAX_BY_EXTENSION;
 /** The outputs the marker scan cannot see: whole generated files. */
-const WHOLE_FILES = [
-  "lib/settings.schema.json",
-  "src/sections/webhooks/events.ts",
-  "src/upstream-gaps/index.ts",
-];
+const WHOLE_FILES = ["lib/settings.schema.json", "src/upstream-gaps/index.ts"];
 
 const tracked = execFileSync("git", ["ls-files", "-z"], { cwd: ROOT, encoding: "utf8" })
   .split("\0")