[Feat] Scripts on events (#1070)

[pietervanleuven]

Closes #1070

Attach an existing Script to a lifecycle event so it runs automatically whenever that event fires in a given project.

Events

Event	Injected variables
Site created	site_domain, site_path, site_type, server_name, server_ip
Site deleted	site_domain, server_name, server_ip
Server installed	server_name, server_ip
Server deleted	server_name, server_ip
Service installed	service_name, service_type, service_version, server_name, server_ip
Service uninstalled	service_name, service_type, server_name, server_ip

Design notes

• Hooks are project-scoped — only fire for events in the configured project.
• Delete events carry scalar primitives (name, IP, project ID) because the model row is gone by the time listeners run.
• Hook failures are caught and logged per-hook; they never surface to the originating action.
• Script variables not present in the event map are filled with '' (no prompt, no abort).

Changes

• ScriptEventHook model + migration + factory
• CreateScriptEventHook / UpdateScriptEventHook actions (project write-access enforced)
• ScriptHookController + ScriptEventHookPolicy + ScriptEventHookResource
• RunScriptEventHooks listener wired to all 6 events in AppServiceProvider
• ExecuteScript::executeForHook() — transaction-wrapped, bypasses user auth
• New events: ServerInstalledEvent, ServerDeletedEvent, ServiceInstalledEvent, ServiceUninstalledEvent
• UI: hooks management sheet + table on the script show page

Testing

16 new feature tests covering CRUD, all 6 event types, disabled/cross-project skip, variable injection, and exception isolation.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5ad89a87-add5-4a9d-8ee7-f8308288ca95

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[RichardAnderson]

Hi @pietervanleuven

Thanks for submitting this PR for Vito, great work. I've taken the opportunity to fix the pre-commit activities for you, as well as resolved some bugs I noticed on review, notably some critical/high issues;

• SSH command injection via unsanitised event-hook variables - app/Listeners/RunScriptEventHooks.php
• Hook updates never re-verify current project write access - app/Policies/ScriptEventHookPolicy.php
• No cross-validation that the server belongs to the selected project - app/Actions/ScriptEventHook/CreateScriptEventHook.php

As well as a number of medium/low issues.

Please do let us know if you plan to continue this PR (I noticed it was still draft), and if so I'll leave the rest for now, otherwise, I'm happy to pick up the remaining testing/updates (where required) for this PR - just let me know.