feat: migrate to Nuxt 4 (Nitro) and Tailwind CSS v3

server/lib/providers/github/index.ts

@@ -0,0 +1,20 @@
+import type { Env, WebhookEvent } from "../../types";
+import type { Provider } from "../types";
+import { verifySignature } from "./verify";
+import { parseEvent } from "./parse";
+
+export const githubProvider: Provider = {
+  id: "github",
+
+  matches(headers) {
+    return headers["x-github-event"] !== undefined;
+  },
+
+  async verify(body, headers, env: Env) {
+    return verifySignature(body, headers["x-hub-signature-256"], env.GITHUB_WEBHOOK_SECRET);
+  },
+
+  parse(body, headers): WebhookEvent | null {
+    return parseEvent(headers, body);
+  },
+};

server/lib/providers/github/parse.ts

@@ -0,0 +1,20 @@
+import type { WebhookEvent } from "../../types";
+
+export function parseEvent(headers: Record<string, string>, body: string): WebhookEvent | null {
+  const event = headers["x-github-event"];
+  const signature = headers["x-hub-signature-256"];
+  const deliveryId = headers["x-github-delivery"];
+
+  if (!event) return null;
+
+  try {
+    const payload = JSON.parse(body) as Record<string, unknown>;
+    const installationId =
+      typeof (payload.installation as { id?: unknown } | undefined)?.id === "number"
+        ? (payload.installation as { id: number }).id
+        : undefined;
+    return { provider: "github", event, payload, signature, deliveryId, installationId };
+  } catch {
+    return null;
+  }
+}

server/lib/providers/github/verify.ts

@@ -0,0 +1,11 @@
+import { hmacSha256Hex, timingSafeEqual } from "../hmac";
+
+export async function verifySignature(
+  payload: string,
+  signature: string | undefined,
+  secret: string,
+): Promise<boolean> {
+  if (!signature || !secret) return false;
+  const expected = `sha256=${await hmacSha256Hex(secret, payload)}`;
+  return timingSafeEqual(signature, expected);
+}