GitHub Deploy-Failed Webhook Automation

​

Overview

1. GitHub emits a deployment failure or workflow failure event.
2. Cloudflare Tunnel exposes the local Hermes webhook listener to the public Internet.
3. Hermes receives the webhook and matches it to a dynamic subscription.
4. Hermes loads the deploy-failed-investigation skill.
5. The skill investigates the failure, attempts a local fix, and reports findings to Telegram.
6. Hermes stops before commit or push and waits for user confirmation.

​

Goals

• Catch deployment failures from GitHub Actions or deployment events.
• Keep the webhook endpoint publicly reachable.
• Run an investigation workflow automatically.
• Report concise findings to Telegram.
• Avoid committing or pushing until explicitly confirmed.
• Record repeat mistakes in Hermes memory and repository notes.

​

Components

​

1. Hermes webhook listener

curl http://localhost:8644/health

​

2. Cloudflare Tunnel

• Tunnel name: hermes-webhook
• Tunnel ID: 4a606722-8ca4-4ac2-8344-62fe6719f84c
• Hostname: gh-webhooks.kokweng.net
• Origin: http://localhost:8644

tunnel: 4a606722-8ca4-4ac2-8344-62fe6719f84c
credentials-file: /Users/gremlin/.cloudflared/4a606722-8ca4-4ac2-8344-62fe6719f84c.json

ingress:
  - hostname: gh-webhooks.kokweng.net
    service: http://localhost:8644
  - service: http_status:404

cloudflared tunnel run hermes-webhook

​

3. Hermes webhook subscription

• Name: github-deploy-failed
• Event: workflow_run
• Delivery: telegram
• Telegram chat ID: 72815965
• Prompt: Telegram-friendly deployment failure alert
• Skill: deploy-failed-investigation

~/.hermes/webhook_subscriptions.json

​

4. Investigation skill

/Users/gremlin/.hermes/skills/devops/deploy-failed-investigation/SKILL.md

• sync /Users/gremlin/Dev/monorepo with main
• inspect the webhook payload and GitHub logs if needed
• debug and fix the issue locally
• report findings and fixes to Telegram
• pause before commit or push
• record repeat mistakes in Hermes memory and AGENTS.md

​

Recommended GitHub event

• Use workflow_run when tracking workflow completion or failure

• Use deployment_status when tracking deployment state transitions

​

Telegram-friendly prompt

Deployment failed

Repo: {repository.full_name}
Workflow: {workflow_run.name}
Branch: {workflow_run.head_branch}
Status: {workflow_run.conclusion}

Next step: summarize the likely cause and what to check first.

​

Webhook URL

https://gh-webhooks.kokweng.net/webhooks/github-deploy-failed

• localhost works only on the local machine.
• GitHub must use the public hostname.
• If the tunnel changes, GitHub must be updated to the new active endpoint.

​

Secret rotation note

• update the GitHub webhook secret
• re-test delivery
• confirm hermes webhook list shows the new subscription state

​

Verification

​

Check subscription

hermes webhook list

​

Check local listener

curl http://localhost:8644/health

​

Check public endpoint

curl -I https://gh-webhooks.kokweng.net/webhooks/github-deploy-failed

​

Related files

• ~/.hermes/webhook_subscriptions.json
• ~/.hermes/.cloudflared/config.yml
• ~/.hermes/skills/devops/deploy-failed-investigation/SKILL.md
• /Users/gremlin/Dev/monorepo/docs/shared/index.mdx
• /Users/gremlin/Dev/monorepo/docs/docs.json