Code hosting integrations

Activation: one natural-language turn

These integrations do not start in a static admin wizard, and users need not manually paste webhook URLs into each forge. The supported flow is:

Describe the goal inside a combo-agent session; the Agent loads the integration skill and handles the rest.

Each SKILL.md encodes a mandatory pipeline; after the trigger phrase matches the agent runs end-to-end—from collecting credentials to webhook validation. Operators only answer “paste your token.”

End-to-end picture

Platform matrix

Credential checklist (ask_user)

Internal pipeline (non-negotiable order)

Step 1 — ask_user + connectivity check

After the secure prompt collects a token, immediate *_verify_token calls surface misconfigurations verbatim—no silent retries.

Step 2 — manage_scm_bot

manage_scm_bot(
  action="create",
  provider="github",
  instance_name="github-uu5208-ragbase",
  credentials_json='{"github_token":"ghp_xxx"}',
  config_json='{"repo":"uu5208/ragbase"}'
)

Responsibilities:

1. Re-run verification (no DB row without a successful remote proof)
2. Insert tenant_channel_bot
3. Echo the full callback URL, e.g., https://combo.example.com/webhook/github-uu5208-ragbase

Step 3 — Provision remote hook

REST path (Git hosts)

github_create_webhook(
  owner="uu5208",
  repo="ragbase",
  instance_name="github-uu5208-ragbase"
)

Agents never ask users to navigate UI settings.

Git path (Gerrit A)

Projects store hooks in refs/meta/config:

[remote "ragbase"]
  url = <callback from Step 2>
  event = patchset-created
  secret = <16-byte random from config_json>
  sslVerify = true

Cron path (Gerrit B fallback)

Use when webhooks are impossible (missing plugin, policy blocks, air-gapped sandbox):

manage_cron_job(
  action="create",
  name="gerrit-poll-{project_slug}",
  schedule_type="every",
  schedule_value="10m",
  prompt="gerrit_list_changes(query='project:{project} status:open'); diff vs last_seen"
)

Step 4 — manage_event_trigger binds prompts

manage_event_trigger(
  action="create",
  name="github-uu5208-ragbase-pr-review",
  source_type="webhook",
  source_bot_instance="github-uu5208-ragbase",
  event_filter='{"event_type":"pull_request"}',
  execution_mode="main",
  prompt="On PR events: fetch diff, review, post comments…"
)

prompt literally replays when deliveries arrive—session-driven automation in a nutshell.

Step 5 — curl -I validation (mandatory)

curl -sI "<callback URL from Step 2>"

Runtime loop post-configuration

scm_tool_context injects PR/change identifiers so tools fire without brittle URL parsing.

Review feedback modes

Repo reads happen through REST snapshots—whole clones only if contractual.

Multiple bots / identities

Teams often register discrete bots per estate (GH org A, self-hosted GitLab B, corp Gerrit C). Routing inspects SCM URLs → tenant bot metadata.

Troubleshooting cheatsheet

Further reading

• Automotive code review solution
• Automotive reviewer ops guide
• Event triggers
• Cron jobs
• Skills (gerrit-integration, gitlab-integration, github-integration, gitee-integration)