fix: validate webhook trigger type to respect 'On tag' configuration

[BENZOOgataga]

What is this PR about?

This PR fixes an issue where the "On tag" trigger type configuration was being ignored, causing deployments to trigger on regular commits/pushes instead of only on tag events. The fix adds proper validation of webhook events against the configured trigger type for all supported Git providers (GitHub, GitLab, Gitea, and Bitbucket), ensuring that deployments only trigger when the appropriate event type is received.

Changes

• Add validateTriggerType helper function to validate webhook events against configured trigger type
• Support all Git providers: GitHub, GitLab, Gitea, and Bitbucket
• Update application deployment endpoint to validate trigger type before processing
• Update compose deployment endpoint to validate trigger type before processing
• Add comprehensive test suite for trigger type validation
• Fixes Trigger type "On tag" seems ignored, builds triggered by commits/pushes #3710

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

closes #3710

Screenshots (if applicable)

N/A - This is a backend webhook validation fix with no UI changes.

Greptile Overview

Greptile Summary

Adds webhook trigger type validation to respect "On tag" configuration for all Git providers (GitHub, GitLab, Gitea, Bitbucket). The validateTriggerType helper correctly validates webhook events against configured trigger types for applications and compose deployments.

• Fixed critical issue where "On tag" configuration was ignored, causing unwanted deployments
• Comprehensive test coverage for all providers and trigger type combinations
• One logic issue: Bitbucket validation incorrectly accepts tag events when triggerType is "push"

Confidence Score: 3/5

(outdated)

• Safe to merge after fixing the Bitbucket logic issue
• The implementation correctly handles GitHub, GitLab, and Gitea providers with comprehensive test coverage. However, Bitbucket validation has a logic flaw where triggerType: "push" would accept both branch and tag events instead of rejecting tags. This needs to be fixed before merging.
• apps/dokploy/pages/api/deploy/[refreshToken].ts requires a fix to the Bitbucket trigger type validation logic

_{Last reviewed commit: 59b52b8}

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}

[greptile-apps]

_{3 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[BENZOOgataga]

I tested the validation logic locally and everything's working as expected.

What I tested

• GitHub, GitLab, Gitea, and Bitbucket webhook validation
• Both "push" and "tag" trigger types
• Made sure events get rejected when they don't match the configured trigger type
• Fixed the Bitbucket issue Greptile pointed out

All tests passed, including the edge cases.

Why no full E2E testing

I couldn't run the full Dokploy stack locally because of version mismatches (Node 20.16.0 required, I have 22.14.0) and webhook testing needs a public URL (ngrok/localtunnel setup).

Instead, I:

• Added comprehensive unit tests in github.test.ts
• Ran standalone tests to verify the validation function works correctly
• Made sure the logic follows the existing codebase patterns

The fix is pretty straightforward, just checking if the webhook event type matches what's configured before deploying. Let me know if you'd like me to adjust anything!

[BENZOOgataga]

@Siumauricio could you review my PR please?

[SHxKM]

@Siumauricio are there plans to fix this bug?

[BENZOOgataga]

Rebased onto latest canary to resolve the merge conflicts and pushed two updated commits:

be9b022 - the original trigger-type validation fix, replayed on top of canary (resolved an import conflict with logWebhookError in the compose webhook handler)
8a068f3 - the Bitbucket fix Greptile flagged, where triggerType: "push" was incorrectly accepting tag events

Ran the full trigger-type test suite locally (50/50 passing) to confirm nothing regressed during the rebase. Ready for another look whenever you have time.