[giovanni-guidini]

GitLab project webhook reconciliation now persists an opaque creation identity before POST, paginates project hooks to adopt an exact prior attempt, and serializes work per repository. This makes the asynchronous ensure task safe after ambiguous create responses while retaining the existing rule that only a definite 404 permits replacement; verified duplicate cleanup and synchronous repository lifecycle reconciliation remain follow-up work.

Before

missing/404 ──► POST hook ──► response lost
                                │
                                ▼ retry
                             POST again ──► duplicate

This PR

reload repository under lock
    │
    ├── integration changed ──► halt stale task
    │
    └── expected integration
            │
            ▼
        missing/404
    │
    ▼
persist reconciliation ID
    │
    ▼
list every hook page for exact marked URL
    │
    ├── match found ──► adopt + update
    │
    └── no match ─────► POST marked hook
                           │
                           └── response lost ──► retry lists and adopts it
    │
    └── 1,000-hook cap reached ──► halt without POST
    │
    ▼
CAS-store winning hook ID
    │
    ├── success ──► done
    └── race lost ► halt without replacing concurrent repository state

[cursor]

Stale Bugbot comment from a previous run.

[billyvg]

🤖 AI-assisted review, posted on behalf of @billyvg.

[github-actions]

Backend Test Failures

Failures on 8ef0069 in this run:

tests/sentry/notifications/notifications/test_digests.py::DigestNotificationTest::test_digest_email_uses_user_timezone — log

[gw1] linux -- Python 3.13.17 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/notifications/notifications/test_digests.py:252: in test_digest_email_uses_user_timezone
    assert "PST" in pacific_body or "PDT" in pacific_body, (
E   AssertionError: Pacific email should use Pacific timezone, but body was: 
E     
E     Notifications for bar
E     Nov. 1, 2026, 1:53 a.m.  to Nov. 1, 2026, 1:53 a.m. 
E     
E     Lenient Bedbug
E     
E     * oh no (1 event, 0 users)
E       http://testserver/organizations/baz/issues/21/?referrer=digest_email
E     
E     * oh no (1 event, 0 users)
E       http://testserver/organizations/baz/issues/20/?referrer=digest_email
E     
E     
E     
E     Unsubscribe: http://testserver/unsubscribe/baz/project/4559109355143200/?_=1V:1xNnnX:RTb7Ln21pUMQ74-OtV03osSRCfNVPS_HuRDRNbLxgb4&referrer=alert_digest
E     
E   assert ('PST' in '\n\nNotifications for bar\nNov. 1, 2026, 1:53 a.m.  to Nov. 1, 2026, 1:53 a.m. \n\nLenient Bedbug\n\n* oh no (1 event...ribe/baz/project/4559109355143200/?_=1V:1xNnnX:RTb7Ln21pUMQ74-OtV03osSRCfNVPS_HuRDRNbLxgb4&referrer=alert_digest\n' or 'PDT' in '\n\nNotifications for bar\nNov. 1, 2026, 1:53 a.m.  to Nov. 1, 2026, 1:53 a.m. \n\nLenient Bedbug\n\n* oh no (1 event...ribe/baz/project/4559109355143200/?_=1V:1xNnnX:RTb7Ln21pUMQ74-OtV03osSRCfNVPS_HuRDRNbLxgb4&referrer=alert_digest\n')

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 85778f9. Configure here.}

[cursor]

Adopt 404 blocks hook replacement

Medium Severity

A 404 from the adopt update_project_webhook is not handled locally, so it falls through as a terminal not_found failure. That skips both a replacement create and a retry. The stored-id path treats a definite 404 as the signal that it is safe to create; after an ambiguous prior create the listed hook can disappear before the follow-up PUT, leaving the repository without a webhook until something else retriggers reconciliation.

 

^{Reviewed by Cursor Bugbot for commit 85778f9. Configure here.}