feat: include schema version in graph update webhook

[thisisnithin]

Summary by CodeRabbit

• New Features

  • Webhook payloads include composed schema version IDs and an optional published_proposals list (id, name, namespace, federated_graph).
  • Per-proposal PROPOSAL_STATE_UPDATED webhooks are emitted for each proposal that becomes fully published.
  • Proposal matching now identifies and processes multiple proposals per update.

• Bug Fixes

  • Federated graphs are refreshed after composition/deploy to ensure accurate composed schema version tracking and webhook data.

• Tests

  • End-to-end tests validate webhook payloads and published_proposals filtering for publish and delete flows.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Checklist

• I have discussed my proposed changes in an issue and have received approval to proceed.
• I have followed the coding standards of the project.
• Tests or benchmarks have been added or updated.
• Documentation has been updated on https://github.com/wundergraph/cosmo-docs.
• I have read the Contributors Guide.

[coderabbitai]

Walkthrough

Refactors proposal matching to return multiple matches, refreshes federated graphs after compose/deploy to update composedSchemaVersionId, accumulates published proposal details, and expands webhook payloads and emissions to include composedSchemaVersionId, published_proposals, and per-proposal PROPOSAL_STATE_UPDATED events.

Changes

Cohort / File(s)	Summary
Proposal repository refactor controlplane/src/core/repositories/ProposalRepository.ts	Renamed matchSchemaWithProposal → matchSchemaWithProposals; return type changed from an optional single match to an array of { proposalId, proposalSubgraphId }; logic now accumulates and returns all matches.
Call-site updates & guards controlplane/src/core/repositories/SchemaCheckRepository.ts, controlplane/src/core/repositories/SubgraphRepository.ts	Replaced calls to matchSchemaWithProposal with matchSchemaWithProposals; convert boolean/optional checks to matches.length checks and adjust guard branches and messages.
Subgraph publish/delete bufservices controlplane/src/core/bufservices/subgraph/publishFederatedSubgraph.ts, controlplane/src/core/bufservices/subgraph/deleteFederatedSubgraph.ts	Switched from single-match handling to arrays of matches; accumulate proposalDetailsList for proposals that become fully published; after compose/deploy re-fetch federated graphs to refresh composedSchemaVersionId; emit FEDERATED_GRAPH_SCHEMA_UPDATED including composedSchemaVersionId and published_proposals; emit PROPOSAL_STATE_UPDATED per published proposal.
Subgraph repository refresh controlplane/src/core/repositories/SubgraphRepository.ts	After composition/deployment steps, re-fetch updated federated graphs from repository to update in-memory composedSchemaVersionId for each affected graph.
Webhook payload shape controlplane/src/core/webhooks/OrganizationWebhookService.ts	Added optional federated_graph.composedSchemaVersionId?: string to the FederatedGraphSchemaUpdate payload and support for published_proposals in emitted payloads.
Tests controlplane/test/proposal/proposal-webhooks.test.ts	Added end-to-end tests (MSW + mocked ClickHouse) validating published_proposals filtering and per-graph webhook emissions for publish and delete flows across multiple federated graphs.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• fix: validate organization ownership for fetched proposals and proposal details #2389: Modifies ProposalRepository API and related call sites — directly related to the matchSchemaWithProposals rename and usage changes.
• feat: add namespace in the slack notification #2452: Changes webhook payloads in OrganizationWebhookService — related to adding composedSchemaVersionId / published_proposals fields.

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The PR title 'feat: include schema version in graph update webhook' is related to one aspect of the changeset (adding composedSchemaVersionId to webhook payloads), but it significantly understates the scope of the actual changes, which include major refactoring of proposal handling, multiple webhook emissions, and substantial schema/API changes across 5+ core files.	Consider a more comprehensive title that captures the full scope, such as 'feat: enhance proposal webhooks with multi-match support and schema versioning' to better reflect the architectural changes and multiple objectives beyond just including schema version.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@controlplane/src/core/bufservices/subgraph/deleteFederatedSubgraph.ts`:
- Around line 239-255: The published_proposals list currently includes proposals
from all graphs; restrict it to only proposals for the federated graph being
notified by filtering proposalDetailsList to proposals whose federated graph
identifier matches affectedFederatedGraph.id (e.g. proposalDetailsList.filter(p
=> p.federated_graph_id === affectedFederatedGraph.id || p.federatedGraphId ===
affectedFederatedGraph.id).map(...)) so that published_proposals only contains
id/name/namespace for proposals belonging to the targeted federated graph.

In `@controlplane/src/core/bufservices/subgraph/publishFederatedSubgraph.ts`:
- Around line 617-633: published_proposals is currently built from the entire
proposalDetailsList which can include proposals from other graphs; filter
proposalDetailsList to only include proposals belonging to the federated graph
being notified (e.g., proposalDetailsList.filter(p => p.graphId === graph.id)
or, if your data model uses namespace, filter by p.namespace ===
graph.namespace) before mapping to {id, name, namespace} so only graph-scoped
proposals are included in the published_proposals payload.

[codecov]

Codecov Report

❌ Patch coverage is 97.14286% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.21%. Comparing base (223d43a) to head (9db8974).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...ane/src/core/repositories/SchemaCheckRepository.ts	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##            main    #2467       +/-   ##
==========================================
+ Coverage   1.50%   63.21%   +61.71%     
==========================================
  Files        292      296        +4     
  Lines      46748    41474     -5274     
  Branches     431     4312     +3881     
==========================================
+ Hits         703    26219    +25516     
+ Misses     45762    15233    -30529     
+ Partials     283       22      -261     

Files with missing lines	Coverage Δ
...re/bufservices/subgraph/deleteFederatedSubgraph.ts	91.86% <100.00%> (ø)
...e/bufservices/subgraph/publishFederatedSubgraph.ts	89.30% <100.00%> (ø)
...lplane/src/core/repositories/ProposalRepository.ts	93.73% <100.00%> (ø)
...lplane/src/core/repositories/SubgraphRepository.ts	87.22% <100.00%> (ø)
...ne/src/core/webhooks/OrganizationWebhookService.ts	41.47% <ø> (ø)
...ane/src/core/repositories/SchemaCheckRepository.ts	67.51% <0.00%> (ø)

... and 582 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Router-nonroot image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-1b7d65e223efcc9d471d31ff95412a75c6427479-nonroot

[StarpTech]

LGTM