tests/fixtures/webhook/pr_opened.json

{
  "action": "opened",
  "repository": {
    "full_name": "Timmy_Foundation/timmy-config",
    "name": "timmy-config"
  },
  "sender": {
    "username": "alex"
  },
  "pull_request": {
    "number": 123,
    "title": "Test PR",
    "html_url": "https://forge.alexanderwhitestone.com/Timmy_Foundation/timmy-config/pulls/123"
  },
  "installation": {
    "id": 1
  }
}
feat(webhook): GEMINI-HARDEN-04 — authenticated webhook runner\n\nReplace print-only payload parser with production-hardened receiver:\n - HMAC-SHA256 signature verification (X-Gitea-Signature)\n - Event / repo / branch / action allowlists (config + env driven)\n - Idempotent event processing via X-Gitea-Delivery with TTL state file\n - Structured JSON logging (stdout + optional file)\n - Safe dispatch — pre-approved script invocations only, no arbitrary shell\n\nNew files:\n - scripts/webhook_runner.py — main HTTP server + policy engine\n - scripts/webhook_config.yaml — sample configuration\n - tests/test_webhook_runner.py — 40 pytest unit tests\n - tests/fixtures/webhook/*.json — payload fixtures for push/PR/issue\n\nAcceptance criteria:\n ✓ Verify Gitea webhook secret/signature\n ✓ Event, repo, branch, and action allowlists explicit and config-driven\n ✓ No direct git pull, shell execution, or fleet mutation from payload fields\n ✓ Structured logging with accepted/rejected events\n ✓ Idempotency via X-Gitea-Delivery tracking\n ✓ Local test fixtures: push, PR, issue, invalid-signature, unknown-event\n ✓ Deployment notes: config via env vars or scripts/webhook_config.yaml\n\nCloses #436 2026-04-27 09:36:27 -04:00			`{`
			`"action": "opened",`
			`"repository": {`
			`"full_name": "Timmy_Foundation/timmy-config",`
			`"name": "timmy-config"`
			`},`
			`"sender": {`
			`"username": "alex"`
			`},`
			`"pull_request": {`
			`"number": 123,`
			`"title": "Test PR",`
			`"html_url": "https://forge.alexanderwhitestone.com/Timmy_Foundation/timmy-config/pulls/123"`
			`},`
			`"installation": {`
			`"id": 1`
			`}`
			`}`