TentyAll guides

Tenty hooks

A hook is the door your pipeline uses to invite Tenty. Each app has one hook URL. When your pipeline calls it, Tenty runs the actions that are switched on for the app.

Actions

  • Scan the app: a full scan of the live app, started shortly after the call.
  • Plan the check after a deploy: Tenty first reads the structure of the app, compares it with the previous scan and lists what changed: new scripts, new outside hosts, new pages, new connections and a different script size. A planner then chooses which further checks fit the change and the stack, and the app page shows its reason. The checks themselves are plain code, so the same input gives the same answer every run, and the planner only chooses the order and the selection. This action comes with paid plans.

Pick the action on the Tenty hooks card. Each call runs the one you picked.

Which actions answer a call depends on your plan. Every account can open the Tenty hooks card on the Access tab of the app, see the URL and send tests. The card shows what your plan includes.

What you need

  • A verified app. See connect your app.
  • A plan whose hook actions include the one you want, for calls from your pipeline. Accounts without it can send a few tests each month, and the card shows how many are left.

Get the URL

Open the app, then the Access tab. The Tenty hooks card holds the hook URL. It looks like https://…/hooks/thk_… and works as a password: anyone who has it can invite Tenty to act on your app. Keep it in your CI secrets.

Call it from your pipeline

The URL accepts a POST request without a body.

Shell or any CI

curl -fsS -X POST "$TENTY_HOOK"

GitHub Actions: save the URL as the repository secret TENTY_HOOK and add a step after your deploy step.

- name: Invite Tenty
  run: curl -fsS -X POST "$TENTY_HOOK"
  env:
    TENTY_HOOK: ${{ secrets.TENTY_HOOK }}

GitLab CI: save the URL as the masked variable TENTY_HOOK and add a job after your deploy job.

tenty_scan:
  stage: .post
  script:
    - curl -fsS -X POST "$TENTY_HOOK"

Vercel

Webhooks belong to Pro and Enterprise teams.

  1. Open your team in the Vercel dashboard, then Settings and Webhooks
  2. Select the event Deployment Succeeded
  3. Choose the project that serves your domain as the project scope
  4. Paste the hook URL as the endpoint and press Create Webhook
  5. Vercel shows a secret key once. Tenty needs no secret, so press Done

On the Hobby plan, save the hook URL as the repository secret TENTY_HOOK and add this workflow. Vercel reports every deploy to GitHub, and the workflow runs when the production deploy succeeds.

on: deployment_status
jobs:
  tenty:
    if: github.event.deployment_status.state == 'success' && github.event.deployment_status.environment == 'Production'
    runs-on: ubuntu-latest
    steps:
      - run: curl -fsS -X POST "$TENTY_HOOK"
        env:
          TENTY_HOOK: ${{ secrets.TENTY_HOOK }}

Netlify

  1. Open the Netlify project that serves your domain, then Project configuration, Notifications and Deploy notifications
  2. Add a notification and choose the outgoing webhook type
  3. Select the event Deploy succeeded
  4. Paste the hook URL as the destination. The signing secret can stay empty
  5. Save the notification

Cloudflare

Cloudflare does not call a URL after a deploy. When your code deploys from GitHub or GitLab, use the GitHub Actions or GitLab CI step above, placed after your deploy. Workers Builds also publishes build events to a Queue, and a small Worker can forward a successful build to the hook URL.

Tenty ignores the payload that these hosts send with their webhooks.

What happens next

  1. Tenty answers at once with 202 and lists what each action did.
  2. After a short wait, one minute by default, the scan starts. The wait gives the new version time to go live.
  3. The result appears on the app page. The Check logs tab marks the scan as started after a hook call.

Calling the hook sends nothing to your app. Tenty reaches your app through the scan, with the same pace and the same request log as any other scan.

Before, during or after a deploy

The call can go wherever your pipeline has a step. After the deploy shows the new version. Before the deploy shows what is live now. Today the scan is the only action, so the usual place is the last step of the deploy.

One scan an hour

Tenty runs one full scan an hour for each verified app. A call inside that hour gets the answer "status":"merged" for the scan action, with the time when the next scan is possible. Your CI step still succeeds. The scheduled scan and the next call after the hour pick the change up.

Test the connection

Press Send a test on the card. The card says whether a scan was planned or when the next one is possible. A test counts as a scan, so it follows the one scan an hour rule too. Accounts whose plan has no hook actions get a limited number of tests each month.

Replace the URL

Press Replace URL on the card. The old URL stops working at once, so update your CI secret in the same moment.

Answers you may see

  • 202: the call was accepted, each action reports started or merged
  • 403: the plan of the account has no hook actions for calls from a pipeline
  • 404: the URL is not known, it was replaced or has a typo
  • 422: the domain is not verified at the moment