feat: Refactor agent and hub sync for better readability

[maximbigler]

Type of change

• 🐛 Bug fix
• 🚀 New feature
• ❓ Other (please specify): Refactor

Description

Fixes #172
Fixes #211

Refactors the repository-sync and application-deploy flow in internal/hub/applications to make it readable and to remove duplicated/divergent logic. No new feature; behavior is preserved except for the intentional changes called out below.

Application-level deploy state machine

• Introduced updateApplicationStatus as the single chokepoint for every application status write + SSE publish; the four mark* helpers are now thin wrappers over it. Fixes a bug where markDeploymentInProgress published an SSE event twice on a DB error.
• Extracted applyDeployResult (+ deployNotifications) — one shared interpreter of an agent's deploy outcome (err / nil result / !Success / success), replacing two divergent copies that previously lived in the sync path and the manual-deploy path.
• Split Deployer.StartDeploy into dispatchDeploy (transport-only) and StartDeploy (dispatch + mark in-progress). The sync path uses dispatchDeploy via DeployAndWait because processSyncJob already owns the in-progress transition, so each path now marks the application in-progress exactly once instead of twice.
• Rewrote processSyncJob to use linear control flow instead of the success bool + defer pattern.
• Bug fix: terminal status writes now use context.Background() instead of the job context. A deploy that hit the 3-minute job timeout previously wrote its failure status on an already-cancelled context, which could leave the application stuck displaying Syncing.

Unified sync entry points

• Added SyncApplications, the single path that all four sync triggers funnel through (polling, manual repo sync, webhooks, GitHub Actions). It performs consistent repository-status bookkeeping (Syncing → Success/Failed).
• Added CommitResolver with StaticCommit (webhooks and GitHub Actions already carry the pushed SHA) and LatestCommit (polling and commit-less generic webhooks), separating "where the commit comes from" from the shared sync logic.
• SyncRepository, WebhookHandler, handleGenericWebhook, and the GitHub Actions handler now delegate to SyncApplications; the bespoke enqueueGenericApps helper and the inline repository-status updates were removed.

Documentation

• Doc comments make the two-layer model explicit (repository-level sync vs. application-level deploy) and clarify that a repository's SyncStatus reflects whether the sync was dispatched (commits resolved, jobs enqueued), not whether every application finished deploying — per-application progress lives on each Application.

Additional context

Intentional behavior changes (please review)

1. A sync-path transport failure (agent dropped / nil result) now marks the application OutOfSync only, instead of also Unhealthy — matching the manual-deploy path. A dropped connection does not mean the running containers are unhealthy.
2. Webhooks and GitHub Actions now perform the full Syncing → Success/Failed repository bookkeeping like the poller. Previously webhooks marked Success only (never Failed) and GitHub Actions did no repository-status bookkeeping at all. For these synchronous handlers the Syncing state is effectively instantaneous; it is only visibly observable on the polling path during the network commit lookup.
3. Generic webhooks now skip applications with an empty branch (consistent with the poller) and mark the repository Failed if commit resolution fails, instead of silently enqueuing an empty commit.

Out of scope (planned follow-up)

Removing the Default* package-level globals in favor of dependency injection, which also requires reordering the server.go bootstrap. Deliberately left for a separate PR to keep this diff focused and reviewable.

Testing

applications, routes, and websocket suites pass; gofmt / go vet clean. The only failing tests are the Docker-daemon-dependent ones in internal/agent/docker, which this branch does not touch.

[codecov]

Codecov Report

❌ Patch coverage is 74.27293% with 115 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/internal/hub/routes/applications.go	60.78%	13 Missing and 7 partials ⚠️
backend/internal/agent/websocket.go	73.77%	12 Missing and 4 partials ⚠️
backend/internal/hub/websocket/handler.go	60.52%	13 Missing and 2 partials ⚠️
backend/internal/agent/docker/deploy.go	53.84%	7 Missing and 5 partials ⚠️
backend/internal/hub/websocket/deploy.go	73.33%	7 Missing and 5 partials ⚠️
backend/internal/hub/applications/sync.go	73.17%	7 Missing and 4 partials ⚠️
backend/internal/hub/routes/webhooks.go	52.94%	4 Missing and 4 partials ⚠️
backend/cmd/hub/key_rotate.go	0.00%	4 Missing and 1 partial ⚠️
backend/internal/hub/applications/repo_sync.go	85.18%	3 Missing and 1 partial ⚠️
backend/internal/agent/docker/status.go	85.00%	2 Missing and 1 partial ⚠️
... and 4 more

📢 Thoughts on this report? Let us know!

[timokoessler]

We did not check this before no?

[timokoessler]

In theory we could just run the insert and catch duplicate key error like done elsewhere?

[alex289]

Good idea