chore: forward issue/PR/discussion events to Cursor hygiene

[juliusmarminge]

GitHub's native repository webhooks cannot send the Authorization: Bearer ... header that Cursor's automation endpoint requires. A direct repository webhook therefore receives HTTP 401, and the hygiene automation never sees the event.

This adds a GitHub Actions workflow that forwards selected pull request, issue, discussion, issue comment, and discussion comment events to Cursor. The job posts the original GitHub event payload and reads the endpoint and full authorization value from Actions secrets. If either secret is absent, it logs a message and skips the request without failing unrelated repository activity.

After merge, add these Actions secrets:

• CURSOR_T3CODE_WEBHOOK_URL: the Cursor automation webhook URL
• CURSOR_T3CODE_WEBHOOK_AUTH: the full Authorization header value, including Bearer

Do not put either secret in the repository.

Validation: git diff --check and manual review of the staged workflow against the requested event list and request headers.

Built with GPT-5 Codex in the Codex app.

---

Note

Low Risk
CI-only outbound forwarding with read-only permissions; no application or auth logic changes, and missing secrets fail open without blocking merges.

Overview
Adds a GitHub Actions workflow (cursor-hygiene-webhook.yml) so repo activity can reach Cursor’s hygiene automation with a proper Authorization header—something native GitHub webhooks can’t send.

The workflow runs on pushes to main, selected PR, issue, discussion, and comment events. A single job POSTs the raw event JSON from github.event_path, sets X-GitHub-Event and X-GitHub-Delivery, and uses Actions secrets CURSOR_T3CODE_WEBHOOK_URL and CURSOR_T3CODE_WEBHOOK_AUTH (full header value, including Bearer). If either secret is missing, it logs and exits 0 so other CI isn’t blocked. Job permissions are limited to contents: read.

^{Reviewed by Cursor Bugbot for commit 6c7a614. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add cursor-hygiene-webhook workflow to forward issue, PR, and discussion events

• Adds a GitHub Actions workflow that triggers on pushes to main, selected pull request, issue, and discussion lifecycle events, and creation of issue/discussion comments.
• A forward job on ubuntu-24.04 with contents-read permission POSTs the GitHub event payload from github.event_path to a Cursor webhook URL, including authorization, event name, and a delivery header built from the workflow run ID and attempt.
• The job exits successfully with a skip message when either the webhook URL or authorization secret is absent; a failing or timed-out curl (60s max) fails the step.

^{Macroscope summarized 6c7a614.}

[macroscopeapp]

🟡 Medium workflows/cursor-hygiene-webhook.yml:29

Fork and Dependabot pull requests never reach Cursor hygiene: GitHub withholds CURSOR_T3CODE_WEBHOOK_URL and CURSOR_T3CODE_WEBHOOK_AUTH from these pull_request workflows, so this guard exits successfully and drops the selected PR events. Use a trusted event path such as pull_request_target (without executing fork code) and provide a separate supported path for Dependabot events.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @.github/workflows/cursor-hygiene-webhook.yml around line 29:

Fork and Dependabot pull requests never reach Cursor hygiene: GitHub withholds `CURSOR_T3CODE_WEBHOOK_URL` and `CURSOR_T3CODE_WEBHOOK_AUTH` from these `pull_request` workflows, so this guard exits successfully and drops the selected PR events. Use a trusted event path such as `pull_request_target` (without executing fork code) and provide a separate supported path for Dependabot events.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.8 KiB	−3 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	+6 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−9 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.5 KiB	58.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.8 KiB	+189 B (+1.4%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	−2 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.7 KiB	+191 B (+2.8%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.9 KiB	59.3 KiB	+1.4 KiB (+2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 8ea52c8 · PR result: 6c7a614 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit cd347dd. Configure here.}

[juliusmarminge]

Pushes to main now forward merge events for fork and Dependabot PRs, where repository secrets are available. I dropped the pull_request closed trigger so team PR merges do not send both a close event and a push event. Opened, reopened, and ready-for-review triggers remain for same-repo attribution.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a new authenticated GitHub Actions integration that forwards raw repository events to Cursor, creating operational and data-handling behavior beyond a minor CI configuration change. Its event coverage also omits fork and Dependabot pull requests when secrets are withheld, so the workflow merits human review.

Not approved because:

• 1 blocking correctness issue found at or above your repo's Minimum Blocking Severity

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}