feat: auto-generated per-repo webhook secrets with dashboard proxy

- Auto-generate webhook_secret on repository creation (UUID-based)
- Webhook routes use per-repo URLs: /webhook/{platform}/{repo_id}
- Verify signatures using per-repo secret (not global env var)
- Dashboard proxies webhooks to agent (agent not exposed publicly)
- Edit modal shows webhook URL + secret for user to copy into Gitea
- Add webhook-config API endpoint to retrieve per-repo secret
- Add Gitea option to edit dialog tracker type dropdown

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

compliance-dashboard/src/infrastructure/repositories.rs

@@ -216,6 +216,31 @@ pub async fn trigger_repo_scan(repo_id: String) -> Result<(), ServerFnError> {
     Ok(())
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct WebhookConfigResponse {
+    pub webhook_secret: Option<String>,
+    pub tracker_type: String,
+}
+
+#[server]
+pub async fn fetch_webhook_config(repo_id: String) -> Result<WebhookConfigResponse, ServerFnError> {
+    let state: super::server_state::ServerState =
+        dioxus_fullstack::FullstackContext::extract().await?;
+    let url = format!(
+        "{}/api/v1/repositories/{repo_id}/webhook-config",
+        state.agent_api_url
+    );
+
+    let resp = reqwest::get(&url)
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let body: WebhookConfigResponse = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body)
+}
+
 /// Check if a repository has any running scans
 #[server]
 pub async fn check_repo_scanning(repo_id: String) -> Result<bool, ServerFnError> {

compliance-dashboard/src/infrastructure/server.rs

@@ -1,4 +1,4 @@
-use axum::routing::get;
+use axum::routing::{get, post};
 use axum::{middleware, Extension};
 use dioxus::prelude::*;
 use time::Duration;
@@ -63,6 +63,8 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
                 .route("/auth", get(auth_login))
                 .route("/auth/callback", get(auth_callback))
                 .route("/logout", get(logout))
+                // Webhook proxy: forward to agent (no auth required)
+                .route("/webhook/{platform}/{repo_id}", post(webhook_proxy))
                 .serve_dioxus_application(ServeConfig::new(), app)
                 .layer(Extension(PendingOAuthStore::default()))
                 .layer(middleware::from_fn(require_auth))
@@ -77,6 +79,53 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
         })
 }
 
+/// Forward incoming webhooks to the agent's webhook server.
+/// The dashboard acts as a public-facing proxy so the agent isn't exposed directly.
+async fn webhook_proxy(
+    Extension(state): Extension<ServerState>,
+    axum::extract::Path((platform, repo_id)): axum::extract::Path<(String, String)>,
+    headers: axum::http::HeaderMap,
+    body: axum::body::Bytes,
+) -> axum::http::StatusCode {
+    // The agent_api_url typically looks like "http://agent:3001" or "http://localhost:3001"
+    // Webhook routes are on the same server, so strip any trailing path
+    let base = state.agent_api_url.trim_end_matches('/');
+    // Remove /api/v1 suffix if present to get base URL
+    let base = base
+        .strip_suffix("/api/v1")
+        .or_else(|| base.strip_suffix("/api"))
+        .unwrap_or(base);
+    let agent_url = format!("{base}/webhook/{platform}/{repo_id}");
+
+    // Forward all relevant headers
+    let client = reqwest::Client::new();
+    let mut req = client.post(&agent_url).body(body.to_vec());
+
+    for (name, value) in &headers {
+        let name_str = name.as_str().to_lowercase();
+        // Forward platform-specific headers
+        if name_str.starts_with("x-gitea-")
+            || name_str.starts_with("x-github-")
+            || name_str.starts_with("x-hub-")
+            || name_str.starts_with("x-gitlab-")
+            || name_str == "content-type"
+        {
+            if let Ok(v) = value.to_str() {
+                req = req.header(name.as_str(), v);
+            }
+        }
+    }
+
+    match req.send().await {
+        Ok(resp) => axum::http::StatusCode::from_u16(resp.status().as_u16())
+            .unwrap_or(axum::http::StatusCode::BAD_GATEWAY),
+        Err(e) => {
+            tracing::error!("Webhook proxy failed: {e}");
+            axum::http::StatusCode::BAD_GATEWAY
+        }
+    }
+}
+
 /// Seed three default MCP server configs (Findings, SBOM, DAST) if they don't already exist.
 async fn seed_default_mcp_servers(db: &Database, mcp_endpoint_url: Option<&str>) {
     let endpoint = mcp_endpoint_url.unwrap_or("http://localhost:8090");

compliance-dashboard/src/pages/repositories.rs

@@ -47,6 +47,8 @@ pub fn RepositoriesPage() -> Element {
     let mut edit_tracker_repo = use_signal(String::new);
     let mut edit_tracker_token = use_signal(String::new);
     let mut edit_saving = use_signal(|| false);
+    let mut edit_webhook_secret = use_signal(|| Option::<String>::None);
+    let mut edit_webhook_tracker = use_signal(String::new);
     let mut scanning_ids = use_signal(Vec::<String>::new);
     let mut graph_repo_id = use_signal(|| Option::<String>::None);
 
@@ -345,6 +347,7 @@ pub fn RepositoriesPage() -> Element {
                             option { value: "", "None" }
                             option { value: "github", "GitHub" }
                             option { value: "gitlab", "GitLab" }
+                            option { value: "gitea", "Gitea" }
                             option { value: "jira", "Jira" }
                         }
                     }
@@ -375,6 +378,39 @@ pub fn RepositoriesPage() -> Element {
                             oninput: move |e| edit_tracker_token.set(e.value()),
                         }
                     }
+                    // Webhook configuration section
+                    if let Some(secret) = edit_webhook_secret() {
+                        h4 {
+                            style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);",
+                            "Webhook Configuration"
+                        }
+                        p {
+                            style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
+                            "Add this webhook in your repository settings to enable push-triggered scans and PR reviews."
+                        }
+                        div { class: "form-group",
+                            label { "Webhook URL" }
+                            input {
+                                r#type: "text",
+                                readonly: true,
+                                style: "font-family: monospace; font-size: 12px;",
+                                value: format!("/webhook/{}/{eid}", edit_webhook_tracker()),
+                            }
+                            p {
+                                style: "font-size: 11px; color: var(--text-secondary); margin-top: 4px;",
+                                "Use the full dashboard URL as the base, e.g. https://your-domain.com/webhook/..."
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Webhook Secret" }
+                            input {
+                                r#type: "text",
+                                readonly: true,
+                                style: "font-family: monospace; font-size: 12px;",
+                                value: "{secret}",
+                            }
+                        }
+                    }
                     div { class: "modal-actions",
                         button {
                             class: "btn btn-secondary",
@@ -496,7 +532,17 @@ pub fn RepositoriesPage() -> Element {
                                                                 edit_tracker_owner.set(edit_repo_data.tracker_owner.clone().unwrap_or_default());
                                                                 edit_tracker_repo.set(edit_repo_data.tracker_repo.clone().unwrap_or_default());
                                                                 edit_tracker_token.set(String::new());
+                                                                edit_webhook_secret.set(None);
+                                                                edit_webhook_tracker.set(String::new());
                                                                 edit_repo_id.set(Some(repo_id_edit.clone()));
+                                                                // Fetch webhook config in background
+                                                                let rid = repo_id_edit.clone();
+                                                                spawn(async move {
+                                                                    if let Ok(cfg) = crate::infrastructure::repositories::fetch_webhook_config(rid).await {
+                                                                        edit_webhook_secret.set(cfg.webhook_secret);
+                                                                        edit_webhook_tracker.set(cfg.tracker_type);
+                                                                    }
+                                                                });
                                                             },
                                                             Icon { icon: BsPencil, width: 16, height: 16 }
                                                         }