Deploy a webhook receiver

import http from "node:http";
import crypto from "node:crypto";

const SECRET = process.env.GITHUB_WEBHOOK_SECRET;    // set on the host, never in git
const seen = new Set();   // in production: a database column with a unique constraint

function verified(body, header = "") {
  const expected = "sha256=" + crypto.createHmac("sha256", SECRET).update(body).digest("hex");
  return header.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}

function handle(event, payload) {
  console.log(event, payload.repository?.full_name);  // your work goes here
}

http.createServer((req, res) => {
  if (req.method !== "POST" || req.url !== "/webhook") return res.writeHead(404).end();
  const chunks = [];
  req.on("data", (c) => chunks.push(c));
  req.on("end", () => {
    const body = Buffer.concat(chunks);                // the raw bytes
    if (!verified(body, req.headers["x-hub-signature-256"])) {
      return res.writeHead(401).end("bad signature");
    }
    res.writeHead(200).end("ok");                      // answer first…
    const id = req.headers["x-github-delivery"];       // same ID on redelivery
    if (seen.has(id)) return;
    seen.add(id);
    handle(req.headers["x-github-event"], JSON.parse(body));  // …then work
  });
}).listen(process.env.PORT || 8080, "0.0.0.0");

FROM node:22-alpine
WORKDIR /app
COPY server.mjs .
ENV PORT=8080
EXPOSE 8080
USER node
CMD ["node", "server.mjs"]