Method ServeHTTP

svc/ctrl/api/github_webhook.go:34–92

ServeHTTP validates the webhook signature and dispatches to event-specific handlers. Currently supports push events for triggering deployments. Unknown event types are acknowledged with 200 OK but not processed.

(w http.ResponseWriter, r *http.Request)

// handlers. Currently supports push events for triggering deployments.
// Unknown event types are acknowledged with 200 OK but not processed.
func (s *GitHubWebhook) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	logger.Info("GitHub webhook request received",
		"method", r.Method,
		"path", r.URL.Path,
		"remote_addr", r.RemoteAddr,
	)

	if r.Method != http.MethodPost {
		logger.Warn("GitHub webhook rejected: method not allowed", "method", r.Method)
		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
		return
	}

	event := r.Header.Get("X-GitHub-Event")
	if event == "" {
		http.Error(w, "missing X-GitHub-Event header", http.StatusBadRequest)
		return
	}

	signature := r.Header.Get("X-Hub-Signature-256")
	if signature == "" {
		logger.Warn("GitHub webhook rejected: missing signature header")
		http.Error(w, "missing X-Hub-Signature-256 header", http.StatusUnauthorized)
		return
	}

	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, maxWebhookBodySize))
	if err != nil {
		logger.Warn("GitHub webhook rejected: failed to read body", "error", err)
		http.Error(w, "failed to read body", http.StatusBadRequest)
		return
	}

	if !githubclient.VerifyWebhookSignature(body, signature, s.webhookSecret) {
		logger.Warn("GitHub webhook rejected: invalid signature")
		http.Error(w, "invalid signature", http.StatusUnauthorized)
		return
	}

	logger.Info("GitHub webhook signature verified", "event", event)

	deliveryID := r.Header.Get("X-GitHub-Delivery")

	switch event {
	case "push":
		s.handlePush(r.Context(), w, body, deliveryID)
	case "pull_request":
		s.handlePullRequest(r.Context(), w, body, deliveryID)
	case "create", "delete":
		logger.Info("Branch lifecycle event ignored", "event", event)
		w.WriteHeader(http.StatusOK)
	case "installation":
		logger.Info("Installation event received")
		w.WriteHeader(http.StatusOK)
	default:
		logger.Info("Unhandled event type", "event", event)
		w.WriteHeader(http.StatusOK)
	}