feat: add gitea/forgejo support

src/providers/gitea/verify.ts

@@ -0,0 +1,15 @@
+import { hmacSha256Hex, timingSafeEqual } from "../hmac";
+
+/**
+ * Gitea signs webhooks with the HMAC-SHA256 hex digest of the raw body in the
+ * `X-Gitea-Signature` header (no `sha256=` prefix, unlike GitHub).
+ */
+export async function verifyGiteaSignature(
+  payload: string,
+  signature: string | undefined,
+  secret: string | undefined,
+): Promise<boolean> {
+  if (!signature || !secret) return false;
+  const expected = await hmacSha256Hex(secret, payload);
+  return timingSafeEqual(signature, expected);
+}