The product is renamed Certifai -> Prüfwerk. This changes only the user-facing
brand text in the documentation (docs/**, VitePress title/name). It does NOT
touch functional identifiers that happen to contain "certifai" (the Docker
network, Keycloak realm/client, Harbor image project, the compliance-* crate
names, or the repo name) — those are infra-coupled and need a separate,
coordinated migration.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

2026-09-02 09:53:45 +02:00

3.4 KiB

Raw Blame History

Webhooks & PR Reviews

Webhooks let Prüfwerk respond to events in your Git repositories automatically. When configured, pushes to your repository trigger scans, and pull requests receive automated security reviews.

What Webhooks Enable

Automatic scans on push -- every time code is pushed to your default branch, a scan is triggered automatically
PR security reviews -- when a pull request is opened or updated, Prüfwerk scans the changes and posts a review comment summarizing any security findings in the diff

Finding the Webhook URL and Secret

Each repository in Prüfwerk has its own webhook URL and secret:

Go to Repositories
Click Edit on the repository you want to configure
In the edit modal, you will find the Webhook URL and Webhook Secret
Copy both values -- you will need them when configuring your Git hosting provider

Setting Up Webhooks

Gitea

Go to your repository in Gitea
Navigate to Settings > Webhooks > Add Webhook > Gitea
Set the Target URL to the webhook URL from Prüfwerk
Set the Secret to the webhook secret from Prüfwerk
Under Trigger On, select:
- Push Events -- for automatic scans on push
- Pull Request Events -- for PR security reviews
Set the content type to application/json
Click Add Webhook

GitHub

Go to your repository on GitHub
Navigate to Settings > Webhooks > Add webhook
Set the Payload URL to the webhook URL from Prüfwerk
Set the Content type to application/json
Set the Secret to the webhook secret from Prüfwerk
Under Which events would you like to trigger this webhook?, select Let me select individual events, then check:
- Pushes -- for automatic scans on push
- Pull requests -- for PR security reviews
Click Add webhook

GitLab

Go to your project in GitLab
Navigate to Settings > Webhooks
Set the URL to the webhook URL from Prüfwerk
Set the Secret token to the webhook secret from Prüfwerk
Under Trigger, check:
- Push events -- for automatic scans on push
- Merge request events -- for PR security reviews
Click Add webhook

PR Review Flow

When a pull request (or merge request) is opened or updated, the following happens:

Your Git provider sends a webhook event to Prüfwerk
Prüfwerk checks out the PR branch and runs a targeted scan on the changed files
Findings specific to the changes in the PR are identified
Prüfwerk posts a review comment on the PR summarizing:
- Number of new findings introduced by the changes
- Severity breakdown
- Details for each finding including file, line, and remediation guidance

This gives developers immediate security feedback in their pull request workflow, before code is merged.

::: tip PR reviews focus only on changes introduced in the pull request, not the entire codebase. This keeps reviews relevant and actionable. :::

Events to Select

Here is a summary of which events to enable for each feature:

Feature	Gitea	GitHub	GitLab
Scan on push	Push Events	Pushes	Push events
PR reviews	Pull Request Events	Pull requests	Merge request events

You can enable one or both depending on your workflow.

::: warning Make sure the webhook secret matches exactly between your Git provider and Prüfwerk. Requests with an invalid signature are rejected. :::

3.4 KiB Raw Blame History