---
id: w1/m18/t004
title: Webhook path-scoped auto-deploy filtering
worker: worker1
status: done
estimate: 1h
depends_on: [w1/m18/t001]
---

## Objective

Scope the git-push auto-deploy webhook so, for an App with `spec.rootDir` set, a push is only redeployed when the pushed diff actually touches files under that subdirectory — matching Render's Root Directory auto-deploy behavior.

## Context

- `lego/backend/internal/apps/webhook.go` — `pushEvent` (lines 54-62) currently only captures `Ref` and repository URLs; `redeployMatching` (lines 98-120) filters solely on `spec.repo` (`repoMatches`) and `spec.branch` (`branchMatches`), gated by `AutoDeploy`.
- GitHub/Gitea push payloads carry a `commits` array, each with `added`/`removed`/`modified` file-path lists — this is the diff data needed for path filtering.
- An App with empty `spec.rootDir` must keep today's behavior exactly (always redeploy on a branch match) — this is a strictly additive filter.

## Steps

1. Extend `pushEvent` to parse `Commits []struct{ Added, Removed, Modified []string }` from the push payload (field name `commits` in both GitHub and Gitea payloads).
2. Add a `pathMatches(rootDir string, commits []commit) bool` helper (or similar) alongside `repoMatches`/`branchMatches`: returns `true` when `rootDir == ""`, or when any commit's added/removed/modified path has `rootDir` as a path-prefix (careful with prefix-vs-substring: `"foo"` must not match `"foobar/x"`).
3. Call the new filter in `redeployMatching`, gated on `a.Spec.RootDir`, alongside the existing repo/branch checks.
4. Note the GitHub payload truncates `commits` to 20 entries for large pushes — document this as a known best-effort limitation (not a correctness bug) rather than trying to call a compare API.

## Files

- `lego/backend/internal/apps/webhook.go`

## Acceptance criteria

- [x] An App with `spec.rootDir` unset redeploys on every matching-branch push, unchanged from today
- [x] An App with `spec.rootDir` set does NOT redeploy when the push's changed files are all outside that path
- [x] An App with `spec.rootDir` set DOES redeploy when at least one changed file falls under that path (prefix match, not substring)
- [x] Path-prefix matching handles trailing/leading slash normalization correctly

## Out of scope

- Falling back to a git compare API call for pushes where `commits` is truncated/absent — best-effort payload parsing only.
