Github webhook implementation #8

billsedison · 2025-08-02T07:40:23Z

No description provided.

github-actions · 2025-08-02T07:40:36Z

prisma/migrations/20250802073602_github_webhook/migration.sql

+ALTER TABLE "reviewApplication" DROP CONSTRAINT "reviewApplication_opportunityId_fkey";
+
+-- AlterTable
+ALTER TABLE "reviewApplication" ALTER COLUMN "opportunityId" SET DATA TYPE TEXT,


Consider verifying if changing the data type of opportunityId to TEXT aligns with the application's data integrity requirements, especially if it was previously a different type such as INTEGER.

github-actions · 2025-08-02T07:40:36Z

prisma/migrations/20250802073602_github_webhook/migration.sql

+
+-- CreateTable
+CREATE TABLE "gitWebhookLog" (
+    "id" VARCHAR(14) NOT NULL DEFAULT nanoid(),


Ensure that the nanoid() function is supported by your database system and that it generates IDs that meet your application's requirements for uniqueness and length.

github-actions · 2025-08-02T07:40:40Z

prisma/schema.prisma

@@ -381,3 +381,15 @@ model reviewApplication {
  @@index([userId])
  @@index([opportunityId])
 }
+
+model gitWebhookLog {
+  id           String   @id @default(dbgenerated("nanoid()")) @db.VarChar(14)


Consider using a more descriptive name for the id field, such as webhookLogId, to make it clear that this ID is specific to the gitWebhookLog model.

github-actions · 2025-08-02T07:40:40Z

prisma/schema.prisma

+
+model gitWebhookLog {
+  id           String   @id @default(dbgenerated("nanoid()")) @db.VarChar(14)
+  eventId      String   // X-GitHub-Delivery header


The comment // X-GitHub-Delivery header could be misleading if the eventId is not directly derived from the header. Ensure that the comment accurately reflects the source or purpose of the field.

github-actions · 2025-08-02T07:40:40Z

prisma/schema.prisma

+model gitWebhookLog {
+  id           String   @id @default(dbgenerated("nanoid()")) @db.VarChar(14)
+  eventId      String   // X-GitHub-Delivery header
+  event        String   // X-GitHub-Event header


The comment // X-GitHub-Event header should be verified to ensure it accurately describes the source of the event field. If the field is not directly from the header, consider updating the comment.

github-actions · 2025-08-02T07:40:40Z

prisma/schema.prisma

+  id           String   @id @default(dbgenerated("nanoid()")) @db.VarChar(14)
+  eventId      String   // X-GitHub-Delivery header
+  event        String   // X-GitHub-Event header
+  eventPayload Json     // Complete webhook payload


Ensure that storing the complete webhook payload as JSON in the eventPayload field does not exceed any database size limitations or performance constraints.

github-actions · 2025-08-02T07:40:46Z

src/api/webhook/interfaces/github-webhook.interface.ts

+
+export interface WebhookRequest {
+  headers: GitHubWebhookHeaders;
+  body: any; // GitHub webhook payload (varies by event type)


Consider using a more specific type instead of any for the body property to improve type safety. If the payload varies by event type, you might define a union type or use generics to handle different payload structures.

github-actions · 2025-08-02T07:40:48Z

src/api/webhook/webhook.controller.ts

+    description: 'Internal Server Error - Processing failed',
+  })
+  async handleGitHubWebhook(
+    @Body() payload: any,


Consider using a more specific type instead of any for the payload parameter to ensure type safety and better code readability.

github-actions · 2025-08-02T07:40:50Z

src/api/webhook/webhook.service.ts

+   * Placeholder for future event-specific processing logic
+   * This method can be extended to handle different GitHub events differently
+   */
+  private handleEventSpecificProcessing(event: string, payload: any): void {


Consider using a more specific type for the payload parameter instead of any to improve type safety and maintainability.

github-actions · 2025-08-02T07:40:51Z

src/api/webhook/webhook.service.ts

+    startDate?: Date;
+    endDate?: Date;
+  }) {
+    try {


Consider adding a return type annotation to the getWebhookLogs method for better clarity and type safety.

github-actions · 2025-08-02T07:40:53Z

src/dto/webhook-event.dto.ts

+  event: string; // From X-GitHub-Event
+
+  @IsNotEmpty()
+  eventPayload: any; // Complete webhook payload


Consider specifying a more precise type for eventPayload instead of using any. This will help with type safety and provide better context for the expected structure of the payload.

github-actions · 2025-08-02T07:40:57Z

src/shared/guards/github-signature.guard.ts

+
+@Injectable()
+export class GitHubSignatureGuard implements CanActivate {
+  private readonly logger = LoggerService.forRoot('GitHubSignatureGuard');


Consider using dependency injection for the LoggerService instead of calling forRoot directly. This will make the code more testable and adhere to the dependency injection pattern used in NestJS.

github-actions · 2025-08-02T07:40:57Z

src/shared/guards/github-signature.guard.ts

+
+    try {
+      // Get the raw body for signature verification
+      const payload = request.body;


The request.body might not always be available in the expected format, especially if middleware like body-parser is not configured correctly. Consider ensuring that the raw body is captured correctly for signature verification, possibly by using a middleware to store the raw body.

github-actions · 2025-08-02T07:40:57Z

src/shared/guards/github-signature.guard.ts

+      const providedSignature = signature;
+
+      // Perform timing-safe comparison to prevent timing attacks
+      const isValid = crypto.timingSafeEqual(


The crypto.timingSafeEqual function requires both buffers to be of the same length. Ensure that expectedSignature and providedSignature are always of the same length before calling this function to prevent runtime errors.

github-actions · 2025-08-04T04:09:51Z

.env.sample

@@ -1,6 +1,10 @@
 POSTGRES_SCHEMA="public"
 DATABASE_URL="postgresql://johndoe:randompassword@localhost:5432/mydb?schema=${POSTGRES_SCHEMA}"

+
+# GitHub Webhook Configuration
+GITHUB_WEBHOOK_SECRET="your_webhook_secret_here"


Consider using a placeholder or example value for GITHUB_WEBHOOK_SECRET that indicates it should be replaced with an actual secret, such as your_actual_webhook_secret_here.

.env.sample

github-actions · 2025-08-04T05:58:47Z

src/api/api.module.ts

@@ -13,6 +13,9 @@ import { ReviewOpportunityService } from './review-opportunity/reviewOpportunity
 import { ReviewApplicationService } from './review-application/reviewApplication.service';
 import { ReviewHistoryController } from './review-history/reviewHistory.controller';
 import { ChallengeApiService } from 'src/shared/modules/global/challenge.service';
+import { WebhookController } from './webhook/webhook.controller';
+import { WebhookService } from './webhook/webhook.service';
+import { GiteaSignatureGuard } from '../shared/guards/gitea-signature.guard';


The import statement has been changed from GitHubSignatureGuard to GiteaSignatureGuard. Ensure that this change is intentional and that the GiteaSignatureGuard is correctly implemented and compatible with the rest of the application. Verify that all references to GitHubSignatureGuard have been updated accordingly throughout the codebase.

github-actions · 2025-08-04T05:58:50Z

src/api/api.module.ts

  ],
  providers: [
    ReviewOpportunityService,
    ReviewApplicationService,
    ChallengeApiService,
+    WebhookService,
+    GiteaSignatureGuard,


The change from GitHubSignatureGuard to GiteaSignatureGuard suggests a switch from GitHub to Gitea for signature verification. Ensure that the rest of the codebase, especially where GitHubSignatureGuard was used, is updated accordingly to handle Gitea signatures. Verify that the GiteaSignatureGuard is correctly implemented and tested for the intended use case.

github-actions · 2025-08-04T05:58:52Z

src/api/webhook/webhook.controller.ts

+  WebhookEventDto,
+  WebhookResponseDto,
+} from '../../dto/webhook-event.dto';
+import { GiteaSignatureGuard } from '../../shared/guards/gitea-signature.guard';


The import statement has been changed from GitHubSignatureGuard to GiteaSignatureGuard. Ensure that this change is intentional and that the rest of the codebase is updated accordingly to reflect this change. If this is part of a broader migration from GitHub to Gitea, verify that all related components and configurations are updated as well.

github-actions · 2025-08-04T05:58:56Z

src/api/webhook/webhook.controller.ts

+    description: 'Internal Server Error - Processing failed',
+  })
+  async handleGiteaWebhook(
+    @Body() payload: any,


Consider using a more specific type instead of any for the payload parameter to improve type safety and code readability.

github-actions · 2025-08-04T05:59:01Z

src/shared/guards/gitea-signature.guard.ts

+
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<Request>();
+    const signature = request.headers['x-hub-signature-256'] as string;


Ensure that the x-hub-signature-256 header is correct for Gitea. If Gitea uses a different header for the signature, it should be updated accordingly.

github-actions · 2025-08-04T06:10:59Z

prisma/migrations/20250804060038_reviewApplication_fkey/migration.sql

+ALTER TABLE "reviewApplication" DROP CONSTRAINT "reviewApplication_opportunityId_fkey";
+
+-- AlterTable
+ALTER TABLE "reviewApplication" ALTER COLUMN "opportunityId" SET DATA TYPE TEXT,


Consider verifying that changing the data type of opportunityId to TEXT does not affect any existing data integrity or application logic that depends on this column being of a specific type.

github-actions · 2025-08-04T06:10:59Z

prisma/migrations/20250804060038_reviewApplication_fkey/migration.sql

+ALTER TABLE "reviewOpportunity" ALTER COLUMN "updatedAt" DROP DEFAULT;
+
+-- AddForeignKey
+ALTER TABLE "reviewApplication" ADD CONSTRAINT "reviewApplication_opportunityId_fkey" FOREIGN KEY ("opportunityId") REFERENCES "reviewOpportunity"("id") ON DELETE CASCADE ON UPDATE CASCADE;


Ensure that the new foreign key constraint with ON DELETE CASCADE ON UPDATE CASCADE is intended, as it will automatically delete or update rows in reviewApplication when corresponding rows in reviewOpportunity are deleted or updated. This could have significant implications for data integrity.

billsedison added 2 commits August 2, 2025 15:36

Github webhook implementation

7b5fb1e

Add Github webhook setup

8b1b7ea

billsedison requested review from jmgasper and kkartunov August 2, 2025 07:40

github-actions bot reviewed Aug 2, 2025

View reviewed changes

Merge branch 'develop' into feat/github-webhook

542e2ec

github-actions bot reviewed Aug 4, 2025

View reviewed changes

Gitea

85c3c70

github-actions bot reviewed Aug 4, 2025

View reviewed changes

reviewApplication fkey

97adfa5

github-actions bot reviewed Aug 4, 2025

View reviewed changes

kkartunov merged commit 52160a0 into develop Aug 4, 2025
1 check passed

Github webhook implementation #8

Github webhook implementation #8

Uh oh!

Conversation

billsedison commented Aug 2, 2025

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!