feat(reconcile): add a Webhook kind

[rohilsurana]

What

Adds a Webhook kind to the reconcile flow, so webhook endpoints can be managed from a
desired-state file like platform users, permissions, roles, and preferences.

How it behaves

This follows the rules in RFC 0001 (docs/rfcs/0001-declarative-reconcile.md), which
already named webhooks as a future kind that fails the plan on a missing entry and deletes
by flag.

• The URL is the identity and never changes. If two endpoints on the server share a URL,
  the plan fails and names their ids, because the URL can no longer tell them apart. Clean
  up the extra one by hand.
• Managed fields are the description, the subscribed events (compared as a set), and the
  state (enabled or disabled). A field you leave out keeps its server value.
• A missing entry fails the plan. Every endpoint on the server must be in the file, kept or
  marked delete: true. Nothing is removed just because a line is gone.
• Deleting needs an explicit delete: true.
• The signing secret is server-owned. The server makes it on create and never returns it on
  read, so it is never in the file, never in a plan, and never in an export. Headers and
  metadata set through other tools are carried through an update untouched.
• Export sorts by URL and leaves out state when it is the default enabled, so it
  round-trips to no changes.

Changes

• internal/reconcile/webhook.go, webhook_reconciler.go: the kind, its diff, and export.
• cmd/reconcile.go: register the kind and update the help text.
• Docs: a Webhook section in the reconcile guide and the CLI reference kinds list.
• Tests mirror the Role kind: diff cases, apply/dry-run/guards, the export round trip, and a
  check that a secret never reaches the output.

Testing

• go test ./internal/reconcile/... passes.
• go build, go vet, gofmt, and golangci-lint are clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Jul 18, 2026 8:10am

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8ee929c1-ab97-4c1c-a95d-1e52337156e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 29637005218

Coverage increased (+0.3%) to 46.363%

Details

• Coverage increased (+0.3%) from the base build.
• Patch coverage: 20 uncovered changes across 3 files (200 of 220 lines covered, 90.91%).
• 1 coverage regression across 1 file.

Uncovered Changes

File	Changed	Covered	%
internal/reconcile/webhook_reconciler.go	106	89	83.96%
internal/reconcile/webhook.go	110	108	98.18%
cmd/reconcile.go	4	3	75.0%

Coverage Regressions

1 previously-covered line in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
cmd/reconcile.go	1	44.19%

---

Coverage Stats

Relevant Lines:	38539
Covered Lines:	17868
Line Coverage:	46.36%
Coverage Strength:	13.37 hits per line

---

💛 - Coveralls