Skip to content

feat: add standalone GitHub webhook relay worker - #133

Open
pandemicsyn wants to merge 16 commits into
mainfrom
codex/github-webhook-relay
Open

pandemicsyn wants to merge 16 commits into
mainfrom
codex/github-webhook-relay

Conversation

@pandemicsyn

Copy link
Copy Markdown
Owner

Summary

  • add a standalone workers/github-webhook-relay Cloudflare Worker package with no Neondeck runtime or dashboard integration
  • verify GitHub webhook HMAC signatures over raw request bytes and validate every HTTP, environment, Durable Object RPC, attachment, and WebSocket protocol boundary with Zod
  • authenticate WebSocket upgrades with a bearer secret and relay versioned webhook envelopes through per-channel hibernating Durable Objects
  • document deployment, secret rotation, protocol, and best-effort delivery semantics
  • add Cloudflare Worker integration coverage for authentication, signatures, channel isolation, duplicate delivery IDs, control frames, and Durable Object eviction/hibernation

Verification

  • cd workers/github-webhook-relay && npm run check (23 tests; format, lint, generated types, TypeScript, Wrangler dry-run)
  • npm run check (63 root test files, 456 tests)
  • wrangler check startup
  • static review after every phase commit; final review has no findings

Existing repository state

The root npm run format:check still reports 15 pre-existing unformatted files outside this branch's changes. The standalone package's format check passes.

@pandemicsyn
pandemicsyn marked this pull request as ready for review July 17, 2026 02:10
Comment on lines +20 to +34
export const githubWebhookEnvelopeSchema = z
.object({
version: protocolVersionSchema,
type: z.literal('github.webhook'),
channel: channelSchema,
deliveryId: z.string().uuid(),
event: z.string().regex(/^[a-z][a-z0-9_]{0,63}$/),
action: z.string().min(1).nullable(),
hookId: z.string().regex(/^\d+$/),
receivedAt: z.string().datetime(),
repository: z.string().min(1).nullable(),
installationId: z.number().int().positive().nullable(),
payload: jsonObjectSchema,
})
.strict();

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Like the zod here, but i think the repo uses another package.

note: test comment

pandemicsyn and others added 13 commits August 16, 2026 21:17
Records the design decisions settled in review: the relay signals when,
not what; no new event bus; hibernating WebSocket over cursor-polling on
DO duty-cycle cost; correctness never depends on the relay.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…nly RPC

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@pandemicsyn
pandemicsyn force-pushed the codex/github-webhook-relay branch from 70db85e to f3f9f4f Compare August 17, 2026 03:25
pandemicsyn and others added 3 commits August 16, 2026 22:51
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant