@@ -62,7 +62,8 @@ type Event struct {
 
 	// HasSkipCommand indicates whether the commit message contains a skip CI command
 	// (e.g., [skip ci], [ci skip], [skip tkn], [tkn skip]). When true, PipelineRun
-	// execution will be skipped unless overridden by a GitOps command (e.g., /test, /retest).
+	// execution will be skipped unless overridden by a GitOps command (e.g., /test, /retest)
+	// or the event came from an incoming webhook, since both are explicit user-triggered runs.
 	// This allows users to bypass CI for documentation changes or minor fixes while still
 	// maintaining the ability to manually trigger builds when needed.
 	HasSkipCommand bool
 
@@ -135,8 +135,8 @@ func (p *PacRun) Run(ctx context.Context) error {
 	// Defensive skip-CI check: this is a safety net in case events bypass the early check in sinker.
 	// Primary skip detection happens in sinker.processEvent() for performance, but this ensures
 	// nothing slips through (e.g., tests that call Run() directly, or edge cases).
-	// Skip only for non-GitOps events (GitOps commands can override skip-CI).
-	if p.event.HasSkipCommand && !opscomments.IsAnyOpsEventType(p.event.EventType) {
+	// Skip CI unless this is a GitOps event or incoming webhook (both override skip-CI markers).
+	if p.event.HasSkipCommand && !opscomments.IsAnyOpsEventType(p.event.EventType) && p.event.EventType != triggertype.Incoming.String() {
 		p.logger.Infof("CI skipped: commit contains skip command in message (secondary check)")
 		return nil
 	}
 
@@ -58,7 +58,7 @@ func replyString(mux *http.ServeMux, url, body string) {
 	})
 }
 
-func testSetupCommonGhReplies(t *testing.T, mux *http.ServeMux, runevent info.Event, finalStatus, finalStatusText string, noReplyOrgPublicMembers bool) {
+func testSetupCommonGhReplies(t *testing.T, mux *http.ServeMux, runevent info.Event, finalStatus, finalStatusText string, noReplyOrgPublicMembers bool, commitMessage string) {
 	t.Helper()
 	// Take a directory and generate replies as Github for it
 	replyString(mux,
@@ -72,11 +72,19 @@ func testSetupCommonGhReplies(t *testing.T, mux *http.ServeMux, runevent info.Ev
 		fmt.Sprintf("/repos/%s/%s/statuses/%s", runevent.Organization, runevent.Repository, runevent.SHA),
 		"{}")
 
-	jj := fmt.Sprintf(`{"sha": "%s", "html_url": "https://git.commit.url/%s", "message": "commit message"}`,
-		runevent.SHA, runevent.SHA)
+	commitMsg := "commit message"
+	if commitMessage != "" {
+		commitMsg = commitMessage
+	}
+	commitJSON, err := json.Marshal(map[string]string{
+		"sha":      runevent.SHA,
+		"html_url": "https://git.commit.url/" + runevent.SHA,
+		"message":  commitMsg,
+	})
+	assert.NilError(t, err)
 	replyString(mux,
 		fmt.Sprintf("/repos/%s/%s/git/commits/%s", runevent.Organization, runevent.Repository, runevent.SHA),
-		jj)
+		string(commitJSON))
 
 	if !noReplyOrgPublicMembers {
 		mux.HandleFunc("/orgs/"+runevent.Organization+"/members", func(rw http.ResponseWriter, _ *http.Request) {
@@ -137,6 +145,7 @@ func TestRun(t *testing.T) {
 		PayloadEncodedSecret         string
 		concurrencyLimit             int
 		expectedLogSnippet           string
+		commitMessage                string
 		expectedPostedComment        string // TODO: multiple posted comments when we need it
 		secretCreationError          error  // Error to inject for secret creation
 	}{
@@ -357,6 +366,27 @@ func TestRun(t *testing.T) {
 			tektondir:   "testdata/push_branch",
 			finalStatus: "neutral",
 		},
+		{
+			// Incoming webhooks are explicit user-triggered runs, so a skip-CI
+			// marker in the head commit message must not suppress them.
+			name: "Incoming/skip-ci-marker-is-ignored",
+			runevent: info.Event{
+				SHA:           "resolvedsha123",
+				Organization:  "organizationes",
+				Repository:    "lagaffe",
+				URL:           "https://service/documentation",
+				Sender:        "incoming",
+				HeadBranch:    "refs/heads/main",
+				BaseBranch:    "refs/heads/main",
+				DefaultBranch: "main",
+				EventType:     triggertype.Incoming.String(),
+				TriggerTarget: "push",
+			},
+			tektondir:          "testdata/push_branch",
+			commitMessage:      "fix: update docs [skip ci]",
+			finalStatus:        "neutral",
+			expectedLogSnippet: "has been created",
+		},
 		{
 			name: "Push/tags",
 			runevent: info.Event{
@@ -611,7 +641,7 @@ func TestRun(t *testing.T) {
 				},
 			}
 
-			testSetupCommonGhReplies(t, mux, tt.runevent, tt.finalStatus, tt.finalStatusText, tt.skipReplyingOrgPublicMembers)
+			testSetupCommonGhReplies(t, mux, tt.runevent, tt.finalStatus, tt.finalStatusText, tt.skipReplyingOrgPublicMembers, tt.commitMessage)
 			if tt.tektondir != "" {
 				ghtesthelper.SetupGitTree(t, mux, tt.tektondir, &tt.runevent, false)
 			}
@@ -738,6 +768,8 @@ func TestRun(t *testing.T) {
 					logURL, ok := pr.Annotations[path.Join(apipac.GroupName, "log-url")]
 					assert.Assert(t, ok, "failed to find log-url label on pipelinerun: %s/%s", pr.GetNamespace(), pr.GetGenerateName())
 					assert.Equal(t, logURL, cs.Clients.ConsoleUI().DetailURL(&pr))
+					assert.Equal(t, pr.Labels[keys.SHA], tt.runevent.SHA, "sha label mismatch on pipelinerun %s", pr.GetName())
+					assert.Equal(t, provider.SkipCI(tt.commitMessage), tt.runevent.HasSkipCommand, "HasSkipCommand mismatch for commit message %q", tt.commitMessage)
 
 					if pacInfo.SecretAutoCreation {
 						secretName, ok := pr.GetAnnotations()[keys.GitAuthSecret]
 
@@ -181,6 +181,10 @@ func TestGithubGHEAppIncomingNoMatchExactName(t *testing.T) {
 }
 
 func verifyIncomingWebhook(t *testing.T, randomedString, pipelinerunName string, entries map[string]string, targets []string, onWebhook bool, numberOfPR int) {
+	verifyIncomingWebhookWithCommitTitle(t, randomedString, pipelinerunName, entries, targets, onWebhook, numberOfPR, "")
+}
+
+func verifyIncomingWebhookWithCommitTitle(t *testing.T, randomedString, pipelinerunName string, entries map[string]string, targets []string, onWebhook bool, numberOfPR int, commitTitle string) {
 	ctx := context.Background()
 	onGHE := true // All incoming webhook tests use GHE
 	ctx, runcnx, opts, ghprovider, err := tgithub.Setup(ctx, onGHE, onWebhook)
@@ -245,6 +249,9 @@ func verifyIncomingWebhook(t *testing.T, randomedString, pipelinerunName string,
 	targetRefName := fmt.Sprintf("refs/heads/%s", randomedString)
 
 	title := "TestGithubAppIncoming - " + randomedString
+	if commitTitle != "" {
+		title = commitTitle
+	}
 	sha, vref, err := tgithub.PushFilesToRef(ctx, ghprovider.Client(), title,
 		repoinfo.GetDefaultBranch(),
 		targetRefName,
@@ -498,6 +505,23 @@ func TestGithubGHEAppIncomingDefaultBranchProvenance(t *testing.T) {
 	assert.NilError(t, err, "Error while checking the logs of the pods")
 }
 
+// TestGithubGHEAppIncomingSkipCI verifies that an incoming webhook creates a
+// PipelineRun even when the HEAD commit message contains a [skip ci] marker.
+// Incoming webhooks are explicit user-triggered runs and must not be suppressed
+// by the skip-CI convention.
+func TestGithubGHEAppIncomingSkipCI(t *testing.T) {
+	randomedString := names.SimpleNameGenerator.RestrictLengthWithRandomSuffix("pac-e2e-ns")
+
+	entries, err := payload.GetEntries(map[string]string{
+		".tekton/pipelinerun-incoming.yaml": "testdata/pipelinerun-incoming.yaml",
+	}, randomedString, randomedString, triggertype.Incoming.String(), map[string]string{})
+	assert.NilError(t, err)
+
+	verifyIncomingWebhookWithCommitTitle(t, randomedString, "pipelinerun-incoming", entries,
+		[]string{randomedString}, false, 1,
+		"chore: update readme [skip ci]")
+}
+
 // Local Variables:
 // compile-command: "go test -tags=e2e -v -run TestGithubAppIncoming ."
 // End: