feat(webhook): per-forge ingress + signature verification (MF-3) #305

Merged

code-lead merged 2 commits from boss/294 into main

2026-04-24 09:11:04 +00:00

code-lead commented

2026-04-23 23:49:44 +00:00

Collaborator

Adds three new HTTP routes (/webhooks/forgejo, /webhooks/github, /webhooks/gitlab) plus a /webhooks alias for back-compat, each applying its forge's signature scheme and normalising the payload to a forge-neutral ForgeEvent discriminated union exported from @claude-hooks/shared. The Forgejo dispatch switch is unchanged; the normaliser scaffolds the shape MF-1 / MF-2 will dispatch on.

Closes #294

Test plan

bun test apps/server — 1128/1128 pass (added 29 new tests)
bun x turbo run typecheck lint — clean
Operator: configure github_webhook_secret_file / gitlab_webhook_secret_file in agents.json, point a GitHub or GitLab webhook at the matching route, confirm 204 on a known event and 403 on a bad signature
Confirm legacy /webhook/forgejo still works (route preserved verbatim)

Adds three new HTTP routes (`/webhooks/forgejo`, `/webhooks/github`, `/webhooks/gitlab`) plus a `/webhooks` alias for back-compat, each applying its forge's signature scheme and normalising the payload to a forge-neutral `ForgeEvent` discriminated union exported from `@claude-hooks/shared`. The Forgejo dispatch switch is unchanged; the normaliser scaffolds the shape MF-1 / MF-2 will dispatch on. Closes #294 ## Test plan - [x] `bun test apps/server` — 1128/1128 pass (added 29 new tests) - [x] `bun x turbo run typecheck lint` — clean - [ ] Operator: configure `github_webhook_secret_file` / `gitlab_webhook_secret_file` in `agents.json`, point a GitHub or GitLab webhook at the matching route, confirm 204 on a known event and 403 on a bad signature - [ ] Confirm legacy `/webhook/forgejo` still works (route preserved verbatim)

code-lead added 1 commit

2026-04-23 23:49:44 +00:00

feat(webhook): per-forge ingress + signature verification (MF-3)

qa / qa (pull_request) Successful in 4m13s

Details

qa / dockerfile (pull_request) Successful in 6s

Details

d7e342f7ec

Adds /webhooks/forgejo, /webhooks/github, /webhooks/gitlab routes (plus
legacy /webhooks alias for Forgejo). Each route applies its forge's
verification scheme — HMAC-SHA256 for Forgejo + GitHub, plaintext token
equality for GitLab — then runs the body through a per-forge normaliser
that returns a forge-neutral ForgeEvent discriminated union exported from
@claude-hooks/shared. The Forgejo dispatch switch is unchanged; the
normaliser exists so MF-1 (GitHub adapter) and MF-2 (GitLab adapter) can
plug into a stable shape.

Closes #294

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

code-lead requested review from reviewer

2026-04-23 23:54:09 +00:00

charles referenced this pull request from a commit

2026-04-24 00:16:01 +00:00

fix(webhook): address review for per-forge ingress (#305 follow-up)

charles added 1 commit

2026-04-24 00:16:01 +00:00

fix(webhook): address review for per-forge ingress (#305 follow-up)

qa / qa (pull_request) Successful in 3m37s

Details

qa / dockerfile (pull_request) Successful in 7s

Details

3f142ad006

- Preserve pre-MF-3 Forgejo route behaviour: unknown events fall through
  to the existing 200 OK path instead of returning 204. The legacy
  /webhooks alias must match current behaviour exactly; 204-on-unknown
  stays scoped to the new /webhooks/github and /webhooks/gitlab routes.
- Add unknown-repo 404 tests for /webhooks/github and /webhooks/gitlab
  so the multi-repo gate (parity with the Forgejo M17-1 contract) is
  covered by the spec alongside sig-fail → 403 and unknown-event → 204.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

code-lead referenced this pull request

2026-04-24 08:47:54 +00:00

feat(webhook): per-forge webhook ingress + signature verification (MF-3) #307

charles referenced this pull request from a commit

2026-04-24 08:50:01 +00:00

fix(webhook): address review for per-forge ingress (#305 follow-up)

charles force-pushed boss/294 from 3f142ad006

qa / qa (pull_request) Successful in 3m37s

Details

qa / dockerfile (pull_request) Successful in 7s

Details

to a1263c41d4