feat(webhook): per-forge webhook ingress + signature verification (MF-3) #307

dev · 2026-04-23T23:53:22Z

dev commented

2026-04-23 23:53:22 +00:00

Three new routes /webhooks/forgejo, /webhooks/github, /webhooks/gitlab with forge-specific signature verification (HMAC-SHA256 for Forgejo/GitHub, static token equality for GitLab). Legacy /webhooks alias kept indefinitely. Unknown events return 204; signature failures return 403.

New ForgeEvent discriminated union in @claude-hooks/shared covers all events the Forgejo dispatch currently handles. Pure normaliser functions (normalizeForgejoPayload, normalizeGitHubPayload, normalizeGitLabPayload) in webhook-normalize.ts translate forge-specific payloads to this shared shape. The existing Forgejo handler is unchanged; GitHub/GitLab routes normalise then dispatch through dispatchForgeEvent using the same handler set.

Test plan

just qa passes — typecheck + Biome lint/format clean
51 normaliser tests pass (webhook-normalize.test.ts) — all three forges produce identical ForgeEvent for equivalent actions; signature-fail scenarios per forge return 403; unknown events return 204; unknown repos return 404
Existing 48 webhook tests unchanged

Closes #294

Three new routes `/webhooks/forgejo`, `/webhooks/github`, `/webhooks/gitlab` with forge-specific signature verification (HMAC-SHA256 for Forgejo/GitHub, static token equality for GitLab). Legacy `/webhooks` alias kept indefinitely. Unknown events return `204`; signature failures return `403`. New `ForgeEvent` discriminated union in `@claude-hooks/shared` covers all events the Forgejo dispatch currently handles. Pure normaliser functions (`normalizeForgejoPayload`, `normalizeGitHubPayload`, `normalizeGitLabPayload`) in `webhook-normalize.ts` translate forge-specific payloads to this shared shape. The existing Forgejo handler is unchanged; GitHub/GitLab routes normalise then dispatch through `dispatchForgeEvent` using the same handler set. ## Test plan - [ ] `just qa` passes — typecheck + Biome lint/format clean - [ ] 51 normaliser tests pass (`webhook-normalize.test.ts`) — all three forges produce identical `ForgeEvent` for equivalent actions; signature-fail scenarios per forge return `403`; unknown events return `204`; unknown repos return `404` - [ ] Existing 48 webhook tests unchanged Closes #294

dev added 1 commit

2026-04-23 23:53:22 +00:00

feat(webhook): per-forge webhook ingress + signature verification (MF-3)

qa / qa (pull_request) Successful in 4m20s

Details

qa / dockerfile (pull_request) Successful in 9s

Details

056899c8b2

Three new routes /webhooks/forgejo, /webhooks/github, /webhooks/gitlab with
forge-specific signature verification (HMAC-SHA256 for Forgejo/GitHub,
static token for GitLab). Legacy /webhooks alias kept for back-compat.

Adds ForgeEvent discriminated union in @claude-hooks/shared and pure
normaliser functions (normalizeForgejoPayload, normalizeGitHubPayload,
normalizeGitLabPayload) in webhook-normalize.ts. Unknown events return
204; signature failures return 403.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dev requested review from reviewer

2026-04-24 00:06:21 +00:00

charles referenced this pull request from a commit

2026-04-24 00:16:12 +00:00

fix(webhook): address review for per-forge ingress (#307 follow-up)

charles added 1 commit

2026-04-24 00:16:12 +00:00

fix(webhook): address review for per-forge ingress (#307 follow-up)

qa / qa (pull_request) Successful in 3m37s

Details

qa / dockerfile (pull_request) Successful in 7s

Details

de81c718aa

Minor hygiene + doc pass on top of the per-forge webhook ingress:

- Drop unused `afterEach` / `mock` imports from webhook-normalize.test.ts
  (Biome doesn't catch these but they misrepresent the test harness).
- Expand the `label_updated` comment in `normalizeForgejoPayload` so
  callers know the first-label pick is deterministic-but-lossy and they
  must iterate `issue.labels` themselves if per-label routing matters
  (matches the semantic the existing Forgejo dispatch switch in
  webhook.ts already uses).

No behaviour change. All 99 webhook + normalize tests still pass;
pre-existing theme / session-pruning / foreman failures unrelated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

code-lead closed this pull request

2026-04-24 08:47:47 +00:00

code-lead commented

2026-04-24 08:47:54 +00:00

Closed as duplicate of #305. Per MF-3 review: #305 uses per-forge webhook secrets (githubSecret/gitlabSecret) which satisfies spec § MF-3 requirement that per-forge secrets be unique to limit blast radius. #307 reuses cfg.secret across all three forges — a leaked Forgejo HMAC would double as a GitLab-webhook impersonation token.