BugViper’s single webhook endpoint at POST /api/v1/webhook/onComment handles three distinct GitHub event types. Each event triggers a different action in the platform. This page describes when each event fires, what conditions cause BugViper to act or skip it, and what the response looks like.
Event summary
| Event | GitHub trigger | BugViper action |
|---|
push | Commits pushed to any branch | Ingest changed files into the graph (skipped if the branch has an open PR) |
pull_request (closed + merged) | PR merged to the base branch | Update the knowledge graph with changes from the merged branch |
issue_comment (created) | New comment on a PR | Trigger AI code review when @bugviper review or @bugviper full review is detected |
push
When it fires
GitHub sends a push event every time commits are pushed directly to any branch in a repository where the BugViper GitHub App is installed.
Required GitHub App permission
What BugViper does
BugViper calls the incremental updater with the before and after commit SHAs. The updater fetches only the changed files and writes the updated nodes to the Neo4j graph — it does not re-clone the entire repository.
When BugViper skips the event
| Condition | Reason |
|---|
after SHA is 0000000000000000000000000000000000000000 | The push is a branch deletion — no files to ingest. |
before SHA is 0000000000000000000000000000000000000000 | A new branch was just created with no commits of its own yet. Use the full ingestion endpoint instead. |
| Branch has an open pull request | The PR review flow owns those changes. Ingesting mid-PR would write an unmerged intermediate state to the graph, which would corrupt search results and AI reviews for that PR. |
Response
{
"status": "processing",
"job_id": "inc-push-3f8a1b2c4d5e",
"repo": "acme-corp/my-api",
"ref": "refs/heads/main",
"commits": "a1b2c3d..e4f5g6h"
}
pull_request
When it fires
GitHub sends a pull_request event for many actions (opened, closed, synchronized, etc.). BugViper only processes the closed action when the PR was also merged.
Required GitHub App permissions
- Pull requests: Read
- Contents: Read
What BugViper does
When a PR is merged, BugViper runs an incremental graph update for the files changed in that PR. The PR number is used to fetch the full list of changed files from the GitHub API so the graph reflects the final merged state.
When BugViper skips the event
| Condition | Reason |
|---|
action is not "closed" | Only merged/closed PRs trigger graph updates. |
pull_request.merged is false | The PR was closed without merging — no changes to apply. |
Response
{
"status": "processing",
"job_id": "inc-pr-7a9b2c1d3e4f",
"pr": "acme-corp/my-api#42",
"action": "graph_update"
}
When it fires
GitHub sends an issue_comment event whenever a comment is created, edited, or deleted on any issue or pull request. BugViper only processes created comments on pull requests that mention @bugviper.
Required GitHub App permissions
- Issues: Read (covers PR comments)
- Pull requests: Read and Write (to post review comments)
- Contents: Read (to fetch PR diff and files)
Review commands
| Command in comment | Review type |
|---|
@bugviper review | Incremental review — focuses on new changes only |
@bugviper full review | Complete review — covers all files touched by the PR |
When BugViper skips the event
| Condition | BugViper’s response |
|---|
action is not "created" | Ignored silently. |
Comment author is a bot (type: "Bot" or login contains [bot]) | Ignored silently — prevents infinite loops from bot-to-bot interactions. |
| Comment is on an issue, not a PR | Ignored silently. |
| Repository has not been indexed in BugViper | BugViper posts an error comment instructing the user to ingest the repository first. |
@bugviper is mentioned but the command is unrecognized | BugViper posts a help comment listing the available commands. |
| A review is already running for the same PR | BugViper posts a message asking the user to wait until the current review finishes. |
BugViper filters out bot comments to prevent review loops. If your bot account posts comments that include @bugviper, they will always be ignored. Only comments from accounts where type is not "Bot" and the login does not contain [bot] are processed.
Response when a review is triggered
{
"status": "processing",
"pr": "acme-corp/my-api#42",
"action": "review"
}
Response when ignored
{
"status": "ignored",
"reason": "comment from bot"
}