Fix clippy errors

Starting impl devcontainer spec

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:trixie
+FROM rust:1.97-trixie
 
 ARG USERNAME=dev
 ARG USER_UID=1000
@@ -18,11 +18,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 RUN groupadd --gid ${USER_GID:-1000} $USERNAME \
-    && useradd --uid ${USER_UID:-1000} --gid ${USER_GID:-1000} -m $USERNAME
+    && useradd --uid ${USER_UID:-1000} --gid ${USER_GID:-1000} -m $USERNAME \
+    && rustup component add clippy \
+    && rustup component add rustfmt
+
+
 
 USER $USERNAME
 WORKDIR /home/$USERNAME
-
-ENV PATH="/home/${USERNAME}/.cargo/bin:${PATH}"
-
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable

.devcontainer/devcontainer.json

@@ -12,6 +12,11 @@
     "containerEnv": {
         "SHELL": "/bin/bash"
     },
+    "customizations": {
+        "vscode": {
+            "extensions": ["fill-labs.dependi", "rust-lang.rust-analyzer", "tamasfe.even-better-toml"]
+        }
+    },
     "workspaceMount": "source=${localWorkspaceFolder},target=/workspaces/herald,type=bind",
     "workspaceFolder": "/workspaces/herald",
    	"runArgs": ["--userns=keep-id", "--security-opt", "label=disable"],

.dockerignore

@@ -1,4 +0,0 @@
-target/
-.env
-.devcontainer/
-docs/

.env.example

@@ -16,3 +16,7 @@ GITEA_TIMEOUT=30
 # Optional
 SENTRY_DSN=
 RUST_LOG=info
+RUST_BACKTRACE=1
+
+
+METRICS_BIND_ADDR=

.woodpecker/tests.yml

@@ -3,13 +3,27 @@ when:
         - push
 
 steps:
+    - name: fmt
+      image: rust:1.97
+      commands:
+          - rustup component add rustfmt
+          - cargo fmt --all -- --check
+
     - name: clippy
-      image: rust:1.96
+      image: rust:1.97
       commands:
           - rustup component add clippy
-          - cargo clippy
+          - cargo clippy --workspace --all-targets --all-features -- -D warnings
 
     - name: test
-      image: rust:1.96
+      image: rust:1.97
       commands:
-          - cargo test
+          - cargo test --workspace --all-targets
+
+    - name: container-build
+      image: quay.io/buildah/stable
+      privileged: true
+      volumes:
+          - /data/woodpecker-builds:/data
+      commands:
+          - buildah bud -f Containerfile -t herald-ci .

.zed/settings.json

@@ -1,9 +1,20 @@
 {
+    "languages": {
+        "Rust": {
+            "format_on_save": "on",
+            "formatter": "language_server"
+        }
+    },
     "lsp": {
         "rust-analyzer": {
             "initialization_options": {
                 "check": {
-                    "command": "clippy"
+                    "command": "clippy",
+                    "extraArgs": [
+                        "--",
+                        "-D",
+                        "warnings"
+                    ]
                 }
             }
         }

Cargo.lock

@@ -34,7 +34,7 @@ dependencies = [
  "bytestring",
  "derive_more",
  "encoding_rs",
- "foldhash",
+ "foldhash 0.1.5",
  "futures-core",
  "http 0.2.12",
  "httparse",
@@ -129,7 +129,7 @@ dependencies = [
  "cfg-if",
  "derive_more",
  "encoding_rs",
- "foldhash",
+ "foldhash 0.1.5",
  "futures-core",
  "futures-util",
  "impl-more",
@@ -280,15 +280,6 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 
-[[package]]
-name = "block-buffer"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "block2"
 version = "0.6.2"
@@ -341,18 +332,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "cmov"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
-
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
 [[package]]
 name = "convert_case"
 version = "0.10.0"
@@ -379,31 +358,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
-name = "cpufeatures"
+name = "crossbeam-epoch"
-version = "0.3.0"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
- "libc",
+ "crossbeam-utils",
 ]
 
 [[package]]
-name = "crypto-common"
+name = "crossbeam-utils"
-version = "0.2.2"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "ctutils"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
-dependencies = [
- "cmov",
-]
 
 [[package]]
 name = "darling"
@@ -524,15 +491,15 @@ dependencies = [
 ]
 
 [[package]]
-name = "digest"
+name = "devcontainer-rs"
-version = "0.11.3"
+version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
- "block-buffer",
+ "anyhow",
- "const-oid",
+ "serde",
- "crypto-common",
+ "serde_json",
- "ctutils",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
 ]
 
 [[package]]
@@ -605,6 +572,17 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "evmap"
+version = "11.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b8874945f036109c72242964c1174cf99434e30cfa45bf45fedc983f50046f8"
+dependencies = [
+ "hashbag",
+ "left-right",
+ "smallvec",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.4.1"
@@ -641,6 +619,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -726,6 +710,21 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "generator"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "log",
+ "rustversion",
+ "windows-link",
+ "windows-result",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -778,6 +777,21 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "hashbag"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7040a10f52cba493ddb09926e15d10a9d8a28043708a405931fe4c6f19fac064"
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "foldhash 0.2.0",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.17.1"
@@ -785,24 +799,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
 [[package]]
-name = "herald"
+name = "herald-server"
-version = "1.0.0"
+version = "1.2.0"
 dependencies = [
  "anyhow",
  "axum",
  "bytes",
+ "devcontainer-rs",
  "dotenvy",
  "futures-util",
  "hex",
- "hmac",
+ "metrics",
+ "metrics-exporter-prometheus",
  "openrouter-rs",
  "reqwest 0.12.28",
+ "ring",
  "sentry",
  "sentry-anyhow",
  "serde",
  "serde_json",
- "sha2",
- "subtle",
  "thiserror 2.0.18",
  "tokio",
  "tokio-stream",
@@ -819,15 +834,6 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
-[[package]]
-name = "hmac"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
-dependencies = [
- "digest",
-]
-
 [[package]]
 name = "hostname"
 version = "0.4.2"
@@ -895,15 +901,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
-[[package]]
-name = "hybrid-array"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9155a582abd142abc056962c29e3ce5ff2ad5469f4246b537ed42c5deba857da"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "hyper"
 version = "1.9.0"
@@ -1103,7 +1100,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
@@ -1142,6 +1139,17 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
+[[package]]
+name = "left-right"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8bc015ded5d9b3054dbbdb63332cdd6ee42352ccef19e911e25117490e2f48ee"
+dependencies = [
+ "crossbeam-utils",
+ "loom",
+ "slab",
+]
+
 [[package]]
 name = "libc"
 version = "0.2.186"
@@ -1181,6 +1189,19 @@ version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
+[[package]]
+name = "loom"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
+dependencies = [
+ "cfg-if",
+ "generator",
+ "scoped-tls",
+ "tracing",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "lru-slab"
 version = "0.1.2"
@@ -1208,12 +1229,70 @@ version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
+[[package]]
+name = "metrics"
+version = "0.24.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89550ee9f79e88fef3119de263694973a8adb26c21d75322164fb8c493039fe2"
+dependencies = [
+ "portable-atomic",
+ "rapidhash",
+]
+
+[[package]]
+name = "metrics-exporter-prometheus"
+version = "0.18.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1db0d8f1fc9e62caebd0319e11eaec5822b0186c171568f0480b46a0137f9108"
+dependencies = [
+ "base64",
+ "evmap",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "indexmap",
+ "ipnet",
+ "metrics",
+ "metrics-util",
+ "quanta",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "metrics-util"
+version = "0.20.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96f8722f8562635f92f8ed992f26df0532266eb03d5202607c20c0d7e9745e13"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "hashbrown 0.16.1",
+ "metrics",
+ "quanta",
+ "rand",
+ "rand_xoshiro",
+ "rapidhash",
+ "sketches-ddsketch",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -1455,9 +1534,9 @@ checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "openrouter-rs"
-version = "0.10.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7101578df2f54d9013594e94367adbe656521ef6002f03e4577f1e00e57cb4"
+checksum = "25918cfeef40cfd3adea348b268496ee5206eb0408f2aacfe4bdfef2bfbe3bf9"
 dependencies = [
  "derive_builder",
  "dotenvy_macro",
@@ -1602,6 +1681,12 @@ version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
+[[package]]
+name = "portable-atomic"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
+
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -1635,6 +1720,21 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "quanta"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi",
+ "web-sys",
+ "winapi",
+]
+
 [[package]]
 name = "quinn"
 version = "0.11.9"
@@ -1734,6 +1834,33 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_xoshiro"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f703f4665700daf5512dcca5f43afa6af89f09db47fb56be587f80636bda2d41"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "rapidhash"
+version = "4.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5da7e78a036ce858e8d55b7e7dc8ba3a88b78350fd2155d3591bbd966b58589e"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "raw-cpuid"
+version = "11.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
+dependencies = [
+ "bitflags",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -1816,6 +1943,7 @@ dependencies = [
  "hyper-util",
  "js-sys",
  "log",
+ "mime_guess",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -2007,6 +2135,12 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -2268,17 +2402,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -2304,6 +2427,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "sketches-ddsketch"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c6f73aeb92d671e0cc4dca167e59b2deb6387c375391bc99ee743f326994a2b"
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -2516,9 +2645,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
@@ -2701,12 +2830,6 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
 [[package]]
 name = "uname"
 version = "0.1.1"
@@ -2716,6 +2839,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -2981,6 +3110,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"

Cargo.toml

@@ -1,29 +1,34 @@
-[package]
+[workspace]
-name = "herald"
+members = [
-version = "1.0.0"
+    "crates/herald-server",
-edition = "2024"
+    "crates/devcontainer-rs",
+]
+resolver = "3"
 
-[dependencies]
+[workspace.dependencies]
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
-tokio = { version = "1.52", features = ["full"] }
+tokio = { version = "1.53", features = ["full"] }
 tokio-stream = "0.1"
 tokio-util = "0.7"
 futures-util = "0.3"
 serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 sentry = { version = "0.48", features = ["tower-axum-matched-path"] }
-sentry-anyhow = "0.48"
+sentry-anyhow = { version = "0.48", features = ["backtrace"] }
-openrouter-rs = "0.10"
+openrouter-rs = "0.12"
 dotenvy = "0.15"
 tower = "0.5"
-tower-http = {version = "0.6", features = ["trace"] }
+tower-http = { version = "0.6", features = ["trace"] }
 tracing = "0.1"
-tracing-subscriber = { version = "0.3", features=["env-filter"] }
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 axum = "0.8"
-anyhow = "1.0"
+anyhow = { version = "1.0", features = ["backtrace"] }
 thiserror = "2.0"
-hmac = "0.13"
+ring = "0.17"
-sha2 = "0.11"
 hex = "0.4"
-subtle = "2.6"
+bytes = "1.1"
-bytes = "1.11"
+metrics = "0.24"
+metrics-exporter-prometheus = { version = "0.18", default-features = false, features = ["http-listener"] }
+
+[profile.release]
+debug = 1

Containerfile

@@ -1,12 +1,15 @@
-FROM rust:1.96 as builder
+FROM rust:1.97-trixie as builder
 
 WORKDIR /app
-COPY . .
+
-RUN cargo build --release
+COPY Cargo.toml Cargo.lock ./
+COPY crates/ crates/
+
+RUN cargo build --release --package herald-server
 
 
 FROM debian:trixie-slim
 
 WORKDIR /app
-COPY --from=builder /app/target/release/herald .
+COPY --from=builder /app/target/release/herald-server .
-CMD [ "./herald" ]
+CMD [ "./herald-server" ]

README.md

@@ -9,6 +9,7 @@ Herald is a Gitea bot that performs automated AI-powered code reviews on pull re
 - Concurrent review processing with configurable parallelism
 - Graceful shutdown — in-progress reviews finish before the process exits
 - Error tracking via Sentry
+- Prometheus metrics endpoint for monitoring
 - Tiny memory footprint (~4MB) thanks to Rust
 
 ## Installation
@@ -34,6 +35,7 @@ Herald reads its configuration from environment variables (a `.env` file is supp
 | `GITEA_URL` | Base URL of your Gitea instance |
 | `GITEA_TOKEN` | Gitea API token |
 | `GITEA_TIMEOUT` | Gitea API request timeout in seconds |
+| `METRICS_BIND_ADDR` | *(optional)* Bind address for the Prometheus metrics endpoint (e.g. `0.0.0.0:9100`). If unset, the metrics exporter is disabled. |
 | `SENTRY_DSN` | *(optional)* Sentry DSN for error tracking |
 | `RUST_LOG` | *(optional)* Log level, defaults to `info` |
 
@@ -51,3 +53,40 @@ cargo run
 ```
 
 Copy `.env.example` to `.env` and fill in your values before running.
+
+## Metrics
+
+Herald optionally exposes a Prometheus metrics endpoint, useful for scraping with an [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/) or any Prometheus-compatible scraper.
+
+Set `METRICS_BIND_ADDR` (e.g. `0.0.0.0:9100`) to enable it. The metrics are then available at `http://<host>:9100/metrics`.
+
+### Exposed metrics
+
+| Metric | Type | Description |
+|---|---|---|
+| `herald_webhooks_received_total` | counter | Total webhooks received (label: `event_type`) |
+| `herald_webhooks_duplicate_total` | counter | Webhooks rejected as duplicates (label: `event_type`) |
+| `herald_webhooks_channel_full_total` | counter | Webhooks dropped because the bot channel was full (label: `event_type`) |
+| `herald_bot_tasks_active` | gauge | Bot tasks currently in progress |
+| `herald_bot_tasks_completed_total` | counter | Bot tasks completed successfully (label: `event_type`) |
+| `herald_bot_tasks_failed_total` | counter | Bot tasks that failed (label: `event_type`) |
+| `herald_openrouter_cost_cents_total` | counter | Total OpenRouter cost in cents (divide by 100 for USD) |
+
+### OTel collector example
+
+```yaml
+receivers:
+  prometheus:
+    config:
+      scrape_configs:
+        - job_name: herald
+          scrape_interval: 15s
+          static_configs:
+            - targets: ["herald:9100"]
+
+service:
+  pipelines:
+    metrics:
+      receivers: [prometheus]
+      exporters: [otlp]
+```

crates/devcontainer-rs/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "devcontainer-rs"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+tokio = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+anyhow = { workspace = true }
+thiserror = { workspace = true }
+
+[dev-dependencies]
+tempfile = "3"

crates/devcontainer-rs/src/lib.rs

@@ -0,0 +1,152 @@
+use std::{
+    collections::HashMap,
+    path::{Path, PathBuf},
+};
+
+use serde::Deserialize;
+
+#[derive(Debug, Deserialize)]
+pub struct DevContainerBuildSchema {
+    #[serde(default)]
+    pub dockerfile: String,
+    #[serde(default)]
+    pub args: HashMap<String, String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct DevContainerSchema {
+    #[serde(default)]
+    pub name: Option<String>,
+    pub build: DevContainerBuildSchema,
+
+    #[serde(rename = "workspaceFolder", default)]
+    pub workspace_folder: Option<String>,
+
+    #[serde(rename = "containerEnv", default)]
+    pub container_env: HashMap<String, String>,
+
+    #[serde(rename = "postCreateCommand", default)]
+    pub post_create_command: Option<String>,
+
+    #[serde(rename = "postStartCommand", default)]
+    pub post_start_command: Option<String>,
+}
+
+#[derive(Debug)]
+pub struct DevContainer {
+    pub container_file_path: PathBuf,
+    pub name: Option<String>,
+    pub build_args: HashMap<String, String>,
+    pub container_env: HashMap<String, String>,
+    pub workspace_folder: Option<String>,
+    pub post_create_command: Option<String>,
+    pub post_start_command: Option<String>,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum ParseError {
+    #[error("failed to read devcontainer file `{path}`: {source}")]
+    Read {
+        path: PathBuf,
+        source: std::io::Error,
+    },
+
+    #[error("invalid devcontainer JSON in `{path}`: {source}")]
+    Json {
+        path: PathBuf,
+        source: serde_json::Error,
+    },
+
+    #[error("container file `{0}` does not exist or is not a regular file")]
+    ContainerFileNotFound(PathBuf),
+
+    #[error("the devcontainer file path has no parent directory: `{0}`")]
+    InvalidDevContainerPath(PathBuf),
+}
+
+impl TryFrom<(DevContainerSchema, PathBuf)> for DevContainer {
+    type Error = ParseError;
+
+    fn try_from(
+        (schema, devcontainer_path): (DevContainerSchema, PathBuf),
+    ) -> Result<Self, Self::Error> {
+        let base_dir = devcontainer_path
+            .parent()
+            .ok_or_else(|| ParseError::InvalidDevContainerPath(devcontainer_path.clone()))?;
+
+        let container_file_path = base_dir.join(schema.build.dockerfile);
+
+        if !container_file_path.is_file() {
+            return Err(ParseError::ContainerFileNotFound(container_file_path));
+        }
+
+        Ok(Self {
+            container_file_path,
+            name: schema.name,
+            build_args: schema.build.args,
+            container_env: schema.container_env,
+            workspace_folder: schema.workspace_folder,
+            post_create_command: schema.post_create_command,
+            post_start_command: schema.post_start_command,
+        })
+    }
+}
+
+pub async fn parse(path: impl AsRef<Path>) -> Result<DevContainer, ParseError> {
+    let path = path.as_ref().to_path_buf();
+    let contents = tokio::fs::read_to_string(&path)
+        .await
+        .map_err(|source| ParseError::Read {
+            path: path.clone(),
+            source,
+        })?;
+
+    let schema = serde_json::from_str::<DevContainerSchema>(&contents).map_err(|source| {
+        ParseError::Json {
+            path: path.clone(),
+            source,
+        }
+    })?;
+
+    DevContainer::try_from((schema, path))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+
+    #[tokio::test]
+    async fn parses_devcontainer_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let devcontainer_path = dir.path().join("devcontainer.json");
+        let dockerfile_path = dir.path().join("Dockerfile");
+
+        fs::write(&dockerfile_path, "FROM alpine\n").unwrap();
+        fs::write(
+            &devcontainer_path,
+            r#"{
+                "name": "test",
+                "build": {
+                    "dockerfile": "Dockerfile",
+                    "args": {
+                        "VERSION": "1"
+                    }
+                },
+                "workspaceFolder": "/workspace",
+                "containerEnv": {
+                    "RUST_LOG": "debug"
+                }
+            }"#,
+        )
+        .unwrap();
+
+        let config = parse(&devcontainer_path).await.unwrap();
+
+        assert_eq!(config.name.as_deref(), Some("test"));
+        assert_eq!(config.container_file_path, dockerfile_path);
+        assert_eq!(config.build_args.get("VERSION").unwrap(), "1");
+        assert_eq!(config.container_env.get("RUST_LOG").unwrap(), "debug");
+        assert_eq!(config.workspace_folder.as_deref(), Some("/workspace"));
+    }
+}

crates/herald-server/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "herald-server"
+version = "1.2.0"
+edition = "2024"
+
+[dependencies]
+reqwest = { workspace = true }
+tokio = { workspace = true }
+tokio-stream = { workspace = true }
+tokio-util = { workspace = true }
+futures-util = { workspace = true }
+serde_json = { workspace = true }
+serde = { workspace = true }
+sentry = { workspace = true }
+sentry-anyhow = { workspace = true }
+openrouter-rs = { workspace = true }
+dotenvy = { workspace = true }
+tower = { workspace = true }
+tower-http = { workspace = true }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+axum = { workspace = true }
+anyhow = { workspace = true }
+thiserror = { workspace = true }
+ring = { workspace = true }
+hex = { workspace = true }
+bytes = { workspace = true }
+metrics = { workspace = true }
+metrics-exporter-prometheus = { workspace = true }
+devcontainer-rs = { path = "../devcontainer-rs" }

crates/herald-server/src/api.rs

@@ -4,12 +4,10 @@ use axum::http::Request;
 use axum::response::IntoResponse;
 use axum::routing::{get, post};
 use axum::{Json, Router};
-use hmac::{Hmac, KeyInit, Mac};
 use reqwest::StatusCode;
+use ring::hmac;
 use sentry::integrations::tower::{NewSentryLayer, SentryHttpLayer};
 use serde_json::Value;
-use sha2::Sha256;
-use subtle::ConstantTimeEq;
 use tower::ServiceBuilder;
 use tower_http::trace::TraceLayer;
 use tracing::{info, instrument};
@@ -19,6 +17,7 @@ use tokio_util::sync::CancellationToken;
 use crate::consts::{GITEA_EVENT_TYPE_HEADER_NAME, GITEA_SIG_HEADER_NAME, MAX_WEBHOOK_BODY_SIZE};
 use crate::errors::AppError;
 use crate::gitea::WebhookType;
+use crate::metrics;
 use crate::state::AppState;
 
 pub async fn start(app_state: AppState, shutdown: CancellationToken) -> anyhow::Result<()> {
@@ -58,13 +57,18 @@ async fn webhook(
 ) -> Result<impl IntoResponse, AppError> {
     tracing::Span::current().record("webhook_type", tracing::field::debug(&wb));
 
+    let event_type = wb.event_type_str();
+    metrics::webhook_received(event_type);
+
     let event_id = wb.event_id();
     if app_state.bot.check_and_mark(event_id).await {
+        metrics::webhook_duplicate(event_type);
         return Err(AppError::AlreadyProcessedErr);
     }
 
     if app_state.bot_tx.try_send(wb).is_err() {
         app_state.bot.unmark(event_id).await;
+        metrics::webhook_channel_full(event_type);
         return Err(AppError::ChannelFullErr);
     }
 
@@ -105,7 +109,7 @@ where
             });
         });
 
-        let webhook = parse_webhook(&type_header, &app_state.config.bot_name, &body_bytes)?;
+        let webhook = parse_webhook(&type_header, &app_state.bot.name(), &body_bytes)?;
         Ok(WebhookExtract(webhook))
     }
 }
@@ -137,12 +141,7 @@ fn parse_webhook(header: &str, bot_name: &str, body_bytes: &[u8]) -> Result<Webh
 fn verify_signature(secret_key: &[u8], sig_header: &str, body: &[u8]) -> Result<(), AppError> {
     let sig_header_decoded =
         hex::decode(sig_header).map_err(|_| AppError::WebHookSigHeaderInvalidErr)?;
-    let mut mac = Hmac::<Sha256>::new_from_slice(secret_key).map_err(anyhow::Error::from)?;
+    let key = hmac::Key::new(hmac::HMAC_SHA256, secret_key);
 
-    mac.update(body);
+    hmac::verify(&key, body, &sig_header_decoded).map_err(|_| AppError::WebHookSigHeaderInvalidErr)
-
-    let generated_hmac = mac.finalize().into_bytes();
-    bool::from(generated_hmac.ct_eq(&sig_header_decoded))
-        .then_some(())
-        .ok_or(AppError::WebHookSigHeaderInvalidErr)
 }

crates/herald-server/src/bot.rs

@@ -1,10 +1,10 @@
 use crate::{
-    env::EnvConfig,
     gitea::{GiteaAPI, WebhookType},
+    metrics,
     open_router::OpenRouterClient,
 };
 use serde::Deserialize;
-use std::{collections::HashSet, sync::Arc, time::Duration};
+use std::{collections::HashSet, sync::Arc};
 use tokio::sync::Mutex;
 use tokio_util::sync::CancellationToken;
 use tracing::{error, info, instrument};
@@ -20,39 +20,42 @@ pub struct ReviewResult {
 pub struct ReviewItem {
     pub filename: String,
     pub line: Option<u64>,
-    pub code: String,
     pub message: String,
 }
 
 #[derive(Clone)]
 pub struct Bot {
-    config: EnvConfig,
+    bot_name: String,
     gitea_api: GiteaAPI,
     open_router_client: OpenRouterClient,
     http_client: reqwest::Client,
     max_concurrent: usize,
+    open_router_model: String,
     actions_handled: Arc<Mutex<HashSet<u64>>>,
 }
 
 impl Bot {
-    pub fn new(config: EnvConfig) -> anyhow::Result<Self> {
+    pub fn new(
-        let gitea_timeout = config.gitea_timeout;
+        bot_name: String,
-        let open_router_timeout = config.open_router_timeout;
+        gitea_api: GiteaAPI,
-
+        open_router_client: OpenRouterClient,
-        Ok(Self {
+        http_client: reqwest::Client,
-            gitea_api: GiteaAPI::new(&config.gitea_url, &config.gitea_token, gitea_timeout)?,
+        max_concurrent: usize,
-            open_router_client: OpenRouterClient::new(
+        open_router_model: String,
-                &config.open_router_api_key,
+    ) -> Self {
-                &config.open_router_model,
+        Self {
-                open_router_timeout,
+            bot_name,
-            )?,
+            gitea_api,
-            max_concurrent: config.bot_max_concurrent,
+            open_router_client,
-            config,
+            http_client,
+            max_concurrent,
+            open_router_model,
             actions_handled: Arc::new(Mutex::new(HashSet::new())),
-            http_client: reqwest::Client::builder()
+        }
-                .timeout(Duration::from_secs(gitea_timeout))
+    }
-                .build()?,
+
-        })
+    pub fn name(&self) -> String {
+        self.bot_name.clone()
     }
 
     pub async fn start(
@@ -84,10 +87,12 @@ impl Bot {
             info!(queued = rx.len(), active = tasks.len(), "Webhook received");
             let permit = sem.clone().acquire_owned().await?;
             let self_clone = self.clone();
+            metrics::increment_task_active();
 
             tasks.spawn(async move {
                 self_clone.exec(wb).await;
                 drop(permit);
+                metrics::decrement_task_active();
             });
         }
 
@@ -97,23 +102,35 @@ impl Bot {
         Ok(())
     }
 
-    #[instrument(skip(self))]
+    #[instrument(skip(self, webhook), fields(repo, pr))]
     pub async fn exec(&self, webhook: WebhookType) {
-        tracing::Span::current().record("webhook_type", tracing::field::debug(&webhook));
+        let event_type_str = webhook.event_type_str();
+
+        match &webhook {
+            WebhookType::Review(p) => {
+                tracing::Span::current().record("repo", &p.repository.full_name);
+                tracing::Span::current().record("pr", p.pull_request.number);
+            }
+        };
+
         let exec_result = match webhook {
             WebhookType::Review(review_payload) => crate::bot_actions::review::exec_review(
                 &self.gitea_api,
                 &self.open_router_client,
                 &self.http_client,
-                &self.config.open_router_model,
+                &self.open_router_model,
                 review_payload,
             ),
         }
         .await;
 
         match exec_result {
-            Ok(_) => info!("Task completed"),
+            Ok(_) => {
+                metrics::task_completed(event_type_str);
+                info!("Task completed");
+            }
             Err(err) => {
+                metrics::task_failed(event_type_str);
                 error!(%err, "Task error");
                 sentry_anyhow::capture_anyhow(&err);
             }

crates/herald-server/src/bot_actions/review.rs

@@ -7,10 +7,11 @@ use crate::{
     bot::ReviewResult,
     consts::{BOT_PROCESS_MSG, MAX_DIFF_SIZE, REVIEW_PROMPT},
     gitea::{GiteaAPI, ReviewPayload},
+    metrics,
     open_router::OpenRouterClient,
 };
 
-#[instrument(skip(gitea_api, open_router_client, http_client, review_payload), err)]
+#[instrument(skip(gitea_api, open_router_client, http_client, review_payload))]
 pub async fn exec_review(
     gitea_api: &GiteaAPI,
     open_router_client: &OpenRouterClient,
@@ -48,6 +49,9 @@ pub async fn exec_review(
         let mut review_result = serde_json::from_str::<ReviewResult>(&chat_result.message)?;
 
         review_result.cost = chat_result.cost;
+        if let Some(cost) = review_result.cost {
+            metrics::openrouter_cost_usd(cost);
+        }
 
         let final_review_markdown = review_result_to_markdown(&review_result);
 

crates/herald-server/src/env.rs

@@ -7,16 +7,15 @@ pub struct EnvConfig {
     pub open_router_api_key: String,
     pub open_router_model: String,
     pub open_router_timeout: u64,
-    pub bot_name: String,
     pub bot_max_concurrent: usize,
     pub gitea_url: String,
     pub gitea_token: String,
     pub gitea_timeout: u64,
+    pub metrics_bind_addr: Option<String>,
 }
 
 pub fn load_config() -> anyhow::Result<EnvConfig> {
     let http_port = try_get_env("HTTP_PORT")?.parse()?;
-    let bot_name = try_get_env("BOT_NAME")?;
     let webhook_secret = try_get_env("WEBHOOK_SIG_HEADER_SECRET")?;
     let open_router_api_key = try_get_env("OPEN_ROUTER_API_KEY")?;
     let open_router_model = try_get_env("OPEN_ROUTER_MODEL")?;
@@ -25,11 +24,11 @@ pub fn load_config() -> anyhow::Result<EnvConfig> {
     let gitea_url = try_get_env("GITEA_URL")?;
     let gitea_token = try_get_env("GITEA_TOKEN")?;
     let gitea_timeout = try_get_env("GITEA_TIMEOUT")?.parse()?;
+    let metrics_bind_addr = std::env::var("METRICS_BIND_ADDR").ok();
 
     Ok(EnvConfig {
         http_port,
         webhook_secret,
-        bot_name,
         open_router_api_key,
         open_router_model,
         open_router_timeout,
@@ -37,17 +36,18 @@ pub fn load_config() -> anyhow::Result<EnvConfig> {
         gitea_url,
         gitea_token,
         gitea_timeout,
+        metrics_bind_addr,
     })
 }
 
 pub fn try_get_env(key: &str) -> anyhow::Result<String> {
-    let env = std::env::var(key)?;
+    let env_value = std::env::var(key).map_err(|e| anyhow::anyhow!("{}: {}", key, e))?;
 
-    if env.trim().is_empty() {
+    if env_value.trim().is_empty() {
         return Err(anyhow!(format!("env var {} is empty", key)));
     }
 
-    Ok(env)
+    Ok(env_value)
 }
 
 #[cfg(test)]

crates/herald-server/src/gitea.rs

@@ -29,7 +29,22 @@ impl GiteaAPI {
         })
     }
 
-    #[instrument(skip(self), err)]
+    #[instrument(skip(self))]
+    pub async fn get_authorized_user(&self) -> anyhow::Result<User> {
+        let url = format!("{}/api/v1/user", self.base_url);
+        let res = self.client.get(url).send().await?;
+
+        if !res.status().is_success() {
+            return Err(anyhow::anyhow!(
+                "Failed to get authorized user: {}",
+                res.status()
+            ));
+        }
+
+        res.json::<User>().await.map_err(anyhow::Error::from)
+    }
+
+    #[instrument(skip(self))]
     pub async fn comment(
         &self,
         body: &str,
@@ -57,7 +72,7 @@ impl GiteaAPI {
         res.json::<Comment>().await.map_err(anyhow::Error::from)
     }
 
-    #[instrument(skip(self), err)]
+    #[instrument(skip(self))]
     pub async fn edit_comment(
         &self,
         body: &str,
@@ -85,7 +100,7 @@ impl GiteaAPI {
         Ok(())
     }
 
-    #[instrument(skip(self), err)]
+    #[instrument(skip(self))]
     pub async fn delete_comment(&self, full_name: &str, comment_id: u64) -> anyhow::Result<()> {
         let url = format!(
             "{}/api/v1/repos/{}/issues/comments/{}",
@@ -104,7 +119,7 @@ impl GiteaAPI {
         Ok(())
     }
 
-    #[instrument(skip(self, review_result), err)]
+    #[instrument(skip(self, review_result))]
     pub async fn post_pull_request_review(
         &self,
         review_result: &ReviewResult,
@@ -164,6 +179,12 @@ impl WebhookType {
             WebhookType::Review(payload) => payload.comment.id,
         }
     }
+
+    pub fn event_type_str(&self) -> &'static str {
+        match self {
+            WebhookType::Review(_) => "review",
+        }
+    }
 }
 
 #[derive(Deserialize, Debug)]
@@ -176,7 +197,6 @@ pub struct ReviewPayload {
 
 #[derive(Deserialize, Debug)]
 pub struct PullRequest {
-    pub id: u64,
     pub diff_url: String,
     pub number: u64,
     pub title: String,
@@ -186,12 +206,11 @@ pub struct PullRequest {
 pub struct Comment {
     pub id: u64,
     pub body: String,
-    pub user: User,
 }
 
 #[derive(Deserialize, Debug)]
 pub struct User {
-    pub id: u64,
+    pub login: String,
 }
 
 #[derive(Deserialize, Debug)]
@@ -206,14 +225,6 @@ impl WebhookType {
             _ => Err(AppError::UnknownEventErr),
         }?;
 
-        let pr_body = match &wb {
-            WebhookType::Review(review_payload) => &review_payload.comment.body,
-        };
-
-        if !pr_body.starts_with(&format!("@{}", bot_name)) {
-            return Err(AppError::UnauthorizedUserErr);
-        }
-
         let action = match &wb {
             WebhookType::Review(review_payload) => &review_payload.action,
         };
@@ -222,6 +233,14 @@ impl WebhookType {
             return Err(AppError::InvalidActionErr);
         }
 
+        let pr_body = match &wb {
+            WebhookType::Review(review_payload) => &review_payload.comment.body,
+        };
+
+        if !pr_body.starts_with(&format!("@{}", bot_name)) {
+            return Err(AppError::UnauthorizedUserErr);
+        }
+
         Ok(wb)
     }
 }
@@ -248,7 +267,8 @@ mod tests {
                 "id": 7,
                 "body": "@test_bot LGTM",
                 "user": {
-                    "id": 100
+                    "id": 100,
+                    "login": "test_user"
                 }
             }
         });
@@ -259,10 +279,8 @@ mod tests {
         match result.unwrap() {
             WebhookType::Review(payload) => {
                 assert_eq!(payload.action, "created");
-                assert_eq!(payload.pull_request.id, 42);
                 assert_eq!(payload.comment.id, 7);
                 assert_eq!(payload.comment.body, "@test_bot LGTM");
-                assert_eq!(payload.comment.user.id, 100);
             }
         }
     }
@@ -312,7 +330,8 @@ mod tests {
                 "id": 1,
                 "body": "@test_bot body",
                 "user": {
-                    "id": 1
+                    "id": 1,
+                    "login": "test_user"
                 }
             }
         });
@@ -343,17 +362,16 @@ mod tests {
                 "id": 12,
                 "body": "Needs work",
                 "user": {
-                    "id": 200
+                    "id": 200,
+                    "login": "test_user"
                 }
             }
         });
 
         let payload: ReviewPayload = serde_json::from_value(json).unwrap();
         assert_eq!(payload.action, "created");
-        assert_eq!(payload.pull_request.id, 99);
         assert_eq!(payload.comment.id, 12);
         assert_eq!(payload.comment.body, "Needs work");
-        assert_eq!(payload.comment.user.id, 200);
     }
 
     #[test]
@@ -380,7 +398,8 @@ mod tests {
                 "id": 1,
                 "body": "@other_bot do something",
                 "user": {
-                    "id": 1
+                    "id": 1,
+                    "login": "test_user"
                 }
             }
         });
@@ -406,7 +425,8 @@ mod tests {
                 "id": 1,
                 "body": "just a comment without bot mention",
                 "user": {
-                    "id": 1
+                    "id": 1,
+                    "login": "test_user"
                 }
             }
         });

crates/herald-server/src/main.rs

@@ -1,6 +1,9 @@
-use std::sync::Arc;
+use crate::{
-
+    bot::Bot,
-use crate::{bot::Bot, gitea::WebhookType, state::AppState};
+    gitea::{GiteaAPI, WebhookType},
+    open_router::OpenRouterClient,
+    state::AppState,
+};
 
 use dotenvy::dotenv;
 use tokio::signal::unix::{SignalKind, signal};
@@ -15,6 +18,7 @@ mod consts;
 mod env;
 mod errors;
 mod gitea;
+mod metrics;
 mod open_router;
 mod state;
 
@@ -51,17 +55,38 @@ fn main() -> anyhow::Result<()> {
 async fn run() -> anyhow::Result<()> {
     let config = env::load_config()?;
 
+    if let Some(metric_bind_addr) = &config.metrics_bind_addr {
+        metrics::install(metric_bind_addr)?;
+    }
+
+    let gitea_api = GiteaAPI::new(&config.gitea_url, &config.gitea_token, config.gitea_timeout)?;
+    let gitea_user = gitea_api.get_authorized_user().await?;
+
     info!(
         port = config.http_port,
         model = %config.open_router_model,
         gitea_url = %config.gitea_url,
-        bot_name = %config.bot_name,
+        bot_name = %gitea_user.login,
         "Starting Herald"
     );
 
+    let open_router_client = OpenRouterClient::new(
+        &config.open_router_api_key,
+        &config.open_router_model,
+        config.open_router_timeout,
+    )?;
+
     let shutdown = CancellationToken::new();
 
-    let bot = Bot::new(config.clone())?;
+    let bot = Bot::new(
+        gitea_user.login,
+        gitea_api,
+        open_router_client,
+        reqwest::Client::new(),
+        config.bot_max_concurrent,
+        config.open_router_model.clone(),
+    );
+
     let (tx, rx) = tokio::sync::mpsc::channel::<WebhookType>(config.bot_max_concurrent * 2);
     let app_state = AppState {
         bot_tx: tx,

crates/herald-server/src/metrics.rs

@@ -0,0 +1,88 @@
+use std::{net::SocketAddr, str::FromStr};
+
+use metrics::{Unit, counter, describe_counter, describe_gauge, gauge};
+
+pub fn webhook_received(event_type: &str) {
+    counter!("herald_webhooks_received_total", "event_type" => event_type.to_string()).increment(1);
+}
+
+pub fn webhook_duplicate(event_type: &str) {
+    counter!("herald_webhooks_duplicate_total", "event_type" => event_type.to_string())
+        .increment(1);
+}
+
+pub fn webhook_channel_full(event_type: &str) {
+    counter!("herald_webhooks_channel_full_total", "event_type" => event_type.to_string())
+        .increment(1);
+}
+
+pub fn increment_task_active() {
+    gauge!("herald_bot_tasks_active").increment(1.0);
+}
+
+pub fn decrement_task_active() {
+    gauge!("herald_bot_tasks_active").decrement(1.0);
+}
+
+pub fn task_completed(event_type: &str) {
+    counter!("herald_bot_tasks_completed_total", "event_type" => event_type.to_string())
+        .increment(1);
+}
+
+pub fn task_failed(event_type: &str) {
+    counter!("herald_bot_tasks_failed_total", "event_type" => event_type.to_string()).increment(1);
+}
+
+pub fn openrouter_cost_usd(cost: f64) {
+    counter!("herald_openrouter_cost_cents_total").increment((cost * 100.0).round() as u64);
+}
+
+pub fn describe() {
+    describe_counter!(
+        "herald_webhooks_received_total",
+        Unit::Count,
+        "Total webhooks received"
+    );
+    describe_counter!(
+        "herald_webhooks_duplicate_total",
+        Unit::Count,
+        "Webhooks rejected as duplicates"
+    );
+    describe_counter!(
+        "herald_webhooks_channel_full_total",
+        Unit::Count,
+        "Webhooks dropped because the bot channel was full"
+    );
+    describe_gauge!(
+        "herald_bot_tasks_active",
+        Unit::Count,
+        "Bot tasks currently in progress"
+    );
+    describe_counter!(
+        "herald_bot_tasks_completed_total",
+        Unit::Count,
+        "Bot tasks completed successfully"
+    );
+    describe_counter!(
+        "herald_bot_tasks_failed_total",
+        Unit::Count,
+        "Bot tasks that failed"
+    );
+    describe_counter!(
+        "herald_openrouter_cost_cents_total",
+        Unit::Count,
+        "Total OpenRouter cost in cents (divide by 100 for USD)"
+    );
+}
+
+pub fn install(bind_addr: &str) -> anyhow::Result<()> {
+    describe();
+
+    let builder = metrics_exporter_prometheus::PrometheusBuilder::new();
+    builder
+        .with_http_listener(SocketAddr::from_str(bind_addr)?)
+        .install()?;
+
+    tracing::info!(bind_addr, "Prometheus metrics exporter installed");
+    Ok(())
+}