fix(webhooks/gitea): ignore pushes/events for repos outside the registry

ORCH-6: get_project_by_repo None -> ignored, so events for unknown repos
do not trigger the pipeline.

src/webhooks/gitea.py

@@ -16,6 +16,7 @@ from ..qg.checks import check_ci_green, check_review_approved
 from ..notifications import notify_stage_change, notify_qg_failure, notify_error
 from ..agents.launcher import launcher
 from ..plane_sync import notify_stage_change as plane_notify_stage
+from ..projects import get_project_by_repo
 
 logger = logging.getLogger("orchestrator.webhooks.gitea")
 
@@ -84,6 +85,11 @@ async def handle_push(payload: dict):
 
     repo_name = payload.get("repository", {}).get("name", settings.default_repo)
 
+    # ORCH-6: ignore pushes to repos outside the project registry.
+    if not get_project_by_repo(repo_name):
+        logger.info(f"Gitea push: ignoring unknown repo '{repo_name}'")
+        return
+
     task = get_task_by_repo_branch(repo_name, branch)
     if not task:
         logger.debug(f"Push to '{branch}' — no matching task found")
@@ -167,6 +173,12 @@ async def handle_ci_status(payload: dict):
             return
 
     repo_name = payload.get("repository", {}).get("name", settings.default_repo)
+
+    # ORCH-6: ignore CI status for repos outside the project registry.
+    if not get_project_by_repo(repo_name):
+        logger.info(f"Gitea CI status: ignoring unknown repo '{repo_name}'")
+        return
+
     task = get_task_by_repo_branch(repo_name, branch)
     if not task:
         return
@@ -221,6 +233,11 @@ async def handle_pr(payload: dict):
     if not head_branch:
         return
 
+    # ORCH-6: ignore PR events for repos outside the project registry.
+    if not get_project_by_repo(repo_name):
+        logger.info(f"Gitea PR: ignoring unknown repo '{repo_name}'")
+        return
+
     task = get_task_by_repo_branch(repo_name, head_branch)
     if not task:
         logger.debug(f"PR event for branch '{head_branch}' — no matching task")