Webhooks

Receive an actions.workflow_job event

Beta: webhook event coverage and payload schemas may evolve. See /docs/integrations/webhooks for supported events and delivery limits. A job is queued that a runner group of the repository's organization serves (no pool yet; runnerGroupId names the group when only one serves it), is acquired by a runner of one of the organization's pools (in_progress), or completes (without a pool or runner when it never ran or GitCafe's hosted fleet ran it after it was announced queued), in the transaction of that transition; each is captured once per job, in that order: a job an organization runner takes without having been announced (the hosted pool also served it, or a group was bound since) is announced queued first, in the same transaction. Delivery may be out of order on retries (a retried queued can arrive after in_progress): order a job's events by status and its queuedAt, startedAt and completedAt, as on GitHub. A job whose repository is transferred while it runs sends no completed to the old organization; reconcile with the provider demand read. Jobs no organization group serves, and jobs on or served by instance pools, emit nothing. App installations of the organization receive it with the org:runners permission. The body holds exact job, run, pool and runner identities only: never scripts, environment, secrets, tokens, clone URLs or logs. GitHub-shaped, not GitHub-compatible; reconcile with the provider demand read. GitCafe POSTs an immutable version 1 snapshot to an eligible active endpoint. Verify the timestamp and HMAC-SHA256 over timestamp + '.' + the unchanged UTF-8 request body using the indicated current signing-key generation. The signature value is sha256=<lowercase hex>. Retries reuse body and delivery identity but refresh timestamp and signing key. Delivery attempts are at least once; deduplicate by the signed body event id within each receiver subscription. The delivery header is an inspection identifier and is not covered by the signature. No ordering is promised. A 2xx response acknowledges acceptance. Network failures, 408, 425, 429 and 5xx retry within eight attempts or 24 hours; redirects and other statuses terminate. Retry-After is capped at one hour. See /docs/integrations/webhooks for configuration and failure recovery. This contract does not prove deployed transport qualification.

postWebhookactions.workflow_job

Headers

X-GitCafe-Event'actions.workflow_job' required

The supported event type.

X-GitCafe-Deliverystring required

Stable delivery identifier for inspection. Deduplicate using the signed body event id.

X-GitCafe-Timestampstring required

Unix seconds for this attempt. Check an appropriate receiver replay window before acceptance.

X-GitCafe-Key-Versionstring required

Current signing-key generation used for this attempt.

X-GitCafe-Signaturestring required

HMAC-SHA256 of timestamp + '.' + exact request body bytes. Compare in constant time.

Payload

idstring required
version'1' required
createdAtstring date-time required
type'actions.workflow_job' required
action'queued' | 'in_progress' | 'completed' required

Response

The receiver accepted the event. Any 2xx status has this meaning.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.