Code activity

Skrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.

Code activity is inbound only. Skrum has zero outbound calls to any git host. You configure a webhook on the git side; Skrum verifies the signature and files each push, pull request, and review into the work graph.

1. Create the endpoint. In Project settings → Code, pick a provider (GitHub, GitLab, or Gitea) and click Create endpoint. Skrum shows a payload URL https://<your-skrum>/api/hooks/git/<endpointId> and a signing secret — shown once. Copy both.
2. Configure the git side.
   • GitHub: Repo Settings → Webhooks → Add. Payload URL as shown, content type application/json, Secret = the signing secret. Skrum verifies X-Hub-Signature-256.
   • GitLab: Repo Settings → Webhooks. URL as shown, Secret token = the signing secret. Skrum verifies X-Gitlab-Token.
   • Gitea: Repo Settings → Webhooks → Gitea. URL, Secret = the signing secret. Skrum verifies X-Gitea-Signature.
3. Task refs. Include KEY-123 in a commit message, PR title, or review body — Skrum links the activity to that task.

FAQ

• Rotating the secret? Delete the endpoint and create a new one — that is the only rotation path.
• What happens on signature mismatch? 401, logged with the failure reason in the endpoint's recent-deliveries panel.
• Replay protection? Yes — every delivery is deduped per (endpoint, delivery-id).

See also: Skrum documentation