@shivaedev/effect-github 0.0.0 → 0.3.0

package/src/GitHub.ts

@@ -0,0 +1,52 @@
+import { Effect, Schema, Stream } from "effect";
+import { HttpClient } from "effect/http";
+import { defineService } from "@shivaedev/effect-service/defineService.ts";
+import { checkRuns } from "#checkRuns.ts";
+import { GitHubConfig } from "#GitHubConfig.ts";
+import { GitHubToken } from "#GitHubToken.ts";
+import { rateLimits } from "#rateLimits.ts";
+import { representations } from "#representations.ts";
+import { requests } from "#requests.ts";
+import { stickyComments } from "#stickyComments.ts";
+
+export const GitHub = defineService({
+	id: "@shivaedev/effect-github/GitHub",
+	initialize: Effect.gen(function* () {
+		const config = yield* GitHubConfig;
+		const rates = rateLimits();
+		return {
+			apiUrl: config.apiUrl,
+			rates,
+			request: requests(yield* HttpClient.HttpClient, yield* GitHubToken, rates),
+		};
+	}),
+	methods: ({ apiUrl, rates, request }) => {
+		const { get, ...client } = representations(apiUrl, request, rates.resource);
+		return {
+			bytes: (path: string, accept: string, limit: number) => Effect.map(request(get(path, accept), limit), (entry) => entry.bytes),
+			...client,
+			...stickyComments(client),
+			...checkRuns(client),
+			observations: () => Effect.sync(() => [...rates.observations.values()]),
+			resource: (path: string) => Effect.sync(() => rates.resource(new URL(path, apiUrl).pathname)),
+			text: (path: string, accept: string, limit: number) =>
+				Effect.map(request(get(path, accept), limit), (entry) => new TextDecoder().decode(entry.bytes)),
+		};
+	},
+	requires: [HttpClient.HttpClient, GitHubToken],
+});
+
+export function read<TSchema extends Schema.Constraint>(path: string, schema: TSchema) {
+	return Effect.flatMap(GitHub, (github) => Effect.flatMap(github.read(path), (response) => response.decode(schema)));
+}
+
+export function list<TSchema extends Schema.Constraint>(path: string, schema: TSchema) {
+	return Stream.unwrap(Effect.flatMap(GitHub, (github) => github.list(path))).pipe(
+		Stream.mapEffect((response) => response.decode(Schema.Array(schema))),
+		Stream.flatMap(Stream.fromIterable),
+	);
+}
+
+export function write<TSchema extends Schema.Constraint>(method: "POST" | "PATCH", path: string, body: unknown, schema: TSchema) {
+	return Effect.flatMap(GitHub, (github) => Effect.flatMap(github.write(method, path, body), (response) => response.decode(schema)));
+}

package/src/GitHubConfig.ts

@@ -0,0 +1,5 @@
+import { Context } from "effect";
+
+export const GitHubConfig = Context.Reference<{ readonly apiUrl: string }>("@shivaedev/effect-github/GitHubConfig", {
+	defaultValue: () => ({ apiUrl: "https://api.github.com" }),
+});

package/src/GitHubToken.ts

@@ -0,0 +1,18 @@
+import { Config, Context, Effect, Layer, type Option, type Redacted } from "effect";
+import type { GitHubAppError } from "./errors.ts";
+
+type Token = Option.Option<Redacted.Redacted<string>>;
+
+export class GitHubToken extends Context.Service<GitHubToken, Token | Effect.Effect<Token, GitHubAppError>>()(
+	"@shivaedev/effect-github/GitHubToken",
+) {
+	static readonly fromEnv = Layer.effect(GitHubToken)(
+		Effect.gen(function* () {
+			const token = yield* Config.Redacted("GH_TOKEN").pipe(
+				Config.orElse(() => Config.Redacted("GITHUB_TOKEN")),
+				Config.option,
+			);
+			return token;
+		}),
+	);
+}

package/src/cache.ts

@@ -0,0 +1,25 @@
+import type { Schema } from "effect";
+import type { HttpClientResponse } from "effect/http";
+
+export interface CachedResponse {
+	readonly bytes: Uint8Array;
+	readonly decoded: Map<Schema.Constraint, unknown>;
+	readonly response: HttpClientResponse.HttpClientResponse;
+}
+
+export function responseCache() {
+	const entries = new Map<string, CachedResponse>();
+	return {
+		get: (key: string) => entries.get(key),
+		set(key: string, entry: CachedResponse) {
+			entries.delete(key);
+			entries.set(key, entry);
+			if (entries.size > 1000) {
+				const first = entries.keys().next();
+				if (!first.done) {
+					entries.delete(first.value);
+				}
+			}
+		},
+	};
+}

package/src/checkRuns.ts

@@ -0,0 +1,48 @@
+import { Effect, Schema } from "effect";
+import type { Representations } from "./representations.ts";
+
+export const CheckRunOutput = Schema.Struct({
+	summary: Schema.String,
+	text: Schema.optional(Schema.String),
+	title: Schema.String,
+});
+
+export const CheckRunConclusion = Schema.Literals(["action_required", "cancelled", "failure", "neutral", "success", "skipped", "stale", "timed_out"]);
+export const CheckRunStatus = Schema.Literals(["queued", "in_progress", "completed"]);
+
+export const CreateCheckRun = Schema.Struct({
+	conclusion: Schema.optional(CheckRunConclusion),
+	headSha: Schema.String,
+	name: Schema.String,
+	output: Schema.optional(CheckRunOutput),
+	status: CheckRunStatus,
+}).pipe(Schema.encodeKeys({ headSha: "head_sha" }));
+
+export const UpdateCheckRun = Schema.Union([
+	Schema.Struct({ output: Schema.optional(CheckRunOutput), status: Schema.Literals(["queued", "in_progress"]) }),
+	Schema.Struct({ conclusion: CheckRunConclusion, output: Schema.optional(CheckRunOutput), status: Schema.Literal("completed") }),
+]);
+
+export const CheckRun = Schema.Struct({
+	conclusion: Schema.NullOr(CheckRunConclusion),
+	headSha: Schema.String,
+	id: Schema.Number,
+	name: Schema.String,
+	output: Schema.Struct({ summary: Schema.NullOr(Schema.String), text: Schema.NullOr(Schema.String), title: Schema.NullOr(Schema.String) }),
+	status: CheckRunStatus,
+}).pipe(Schema.encodeKeys({ headSha: "head_sha" }));
+
+export function checkRuns(client: Representations) {
+	return {
+		createCheckRun: Effect.fn("GitHub.createCheckRun")(function* (owner: string, repo: string, input: typeof CreateCheckRun.Type) {
+			const body = yield* Schema.encodeEffect(CreateCheckRun)(input);
+			const response = yield* client.write("POST", `/repos/${owner}/${repo}/check-runs`, body);
+			return yield* response.decode(CheckRun);
+		}),
+		updateCheckRun: Effect.fn("GitHub.updateCheckRun")(function* (owner: string, repo: string, id: number, input: typeof UpdateCheckRun.Type) {
+			const body = yield* Schema.encodeEffect(UpdateCheckRun)(input);
+			const response = yield* client.write("PATCH", `/repos/${owner}/${repo}/check-runs/${id}`, body);
+			return yield* response.decode(CheckRun);
+		}),
+	};
+}

package/src/errors.ts

@@ -0,0 +1,17 @@
+import { Schema } from "effect";
+
+export class GitHubRateLimited extends Schema.TaggedError<GitHubRateLimited>()("GitHubRateLimited", {
+	resource: Schema.String,
+	retryAt: Schema.DateTimeUtc,
+}) {}
+
+export class GitHubTransportError extends Schema.TaggedError<GitHubTransportError>()("GitHubTransportError", {
+	path: Schema.String,
+}) {}
+
+export class GitHubAppError extends Schema.TaggedError<GitHubAppError>()("GitHubAppError", {
+	stage: Schema.Literals(["sign", "exchange"]),
+	status: Schema.optional(Schema.Number),
+}) {}
+
+export class GitHubWebhookSignatureError extends Schema.TaggedError<GitHubWebhookSignatureError>()("GitHubWebhookSignatureError", {}) {}

package/src/githubApp.ts

@@ -0,0 +1,66 @@
+import { sign } from "node:crypto";
+import { Clock, Effect, Exit, Layer, Option, Redacted, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+import { readBoundedJson } from "@shivaedev/platform/http-client/body.ts";
+import { GitHubAppError } from "./errors.ts";
+import { GitHubConfig } from "./GitHubConfig.ts";
+import { GitHubToken } from "./GitHubToken.ts";
+
+export type GitHubAppOptions = {
+	readonly appId: string;
+	readonly privateKey: Redacted.Redacted<string>;
+} & ({ readonly installationId: number } | { readonly owner: string; readonly repository: string });
+
+const Installation = Schema.Struct({ id: Schema.Number });
+const AccessToken = Schema.Struct({ expiresAt: Schema.DateFromString, token: Schema.RedactedFromValue(Schema.String) }).pipe(
+	Schema.encodeKeys({ expiresAt: "expires_at" }),
+);
+
+export function githubApp(options: GitHubAppOptions) {
+	return Layer.effect(GitHubToken)(
+		Effect.gen(function* () {
+			const client = yield* HttpClient.HttpClient;
+			const { apiUrl } = yield* GitHubConfig;
+			const clock = yield* Clock.Clock;
+			let installationId = "installationId" in options ? options.installationId : undefined;
+			const request = appRequests(client, apiUrl);
+			const exchange = Effect.gen(function* () {
+				const now = Math.floor((yield* Clock.currentTimeMillis) / 1000);
+				const jwt = yield* Effect.try({
+					catch: () => new GitHubAppError({ stage: "sign" }),
+					try: () => {
+						const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" })).toString("base64url");
+						const payload = Buffer.from(JSON.stringify({ exp: now + 600, iat: now - 60, iss: options.appId })).toString("base64url");
+						const input = `${header}.${payload}`;
+						return `${input}.${sign("RSA-SHA256", Buffer.from(input), Redacted.value(options.privateKey)).toString("base64url")}`;
+					},
+				});
+				if (installationId === undefined && "owner" in options) {
+					const path = `/repos/${encodeURIComponent(options.owner)}/${encodeURIComponent(options.repository)}/installation`;
+					installationId = (yield* request("GET", path, jwt, Installation)).id;
+				}
+				return yield* request("POST", `/app/installations/${installationId}/access_tokens`, jwt, AccessToken);
+			});
+			const cached = yield* Effect.cachedWithTTL(exchange, (exit) =>
+				Exit.isSuccess(exit) ? Math.max(0, exit.value.expiresAt.getTime() - clock.currentTimeMillisUnsafe() - 300_000) : 0,
+			);
+			return Effect.map(cached, ({ token }) => Option.some(token));
+		}),
+	);
+}
+
+function appRequests(client: HttpClient.HttpClient, apiUrl: string) {
+	return Effect.fnUntraced(function* <TSchema extends Schema.Constraint>(method: "GET" | "POST", path: string, jwt: string, schema: TSchema) {
+		const response = yield* client
+			.execute(
+				HttpClientRequest.make(method)(new URL(path, apiUrl).href, {
+					headers: { Accept: "application/vnd.github+json", Authorization: `Bearer ${jwt}`, "X-GitHub-Api-Version": "2022-11-28" },
+				}),
+			)
+			.pipe(Effect.mapError(() => new GitHubAppError({ stage: "exchange" })));
+		if (response.status < 200 || response.status >= 300) {
+			return yield* new GitHubAppError({ stage: "exchange", status: response.status });
+		}
+		return yield* readBoundedJson(response, 64 * 1024, schema).pipe(Effect.mapError(() => new GitHubAppError({ stage: "exchange" })));
+	});
+}

package/src/json.ts

@@ -0,0 +1,16 @@
+import { Effect, Schema } from "effect";
+import type { CachedResponse } from "./cache.ts";
+
+export const decodeJson = Effect.fnUntraced(function* <TSchema extends Schema.Constraint>(entry: CachedResponse, schema: TSchema) {
+	const cached = entry.decoded.get(schema);
+	if (entry.decoded.has(schema) && Schema.is(schema)(cached)) {
+		return cached;
+	}
+	const value = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(schema))(new TextDecoder().decode(entry.bytes));
+	entry.decoded.set(schema, value);
+	return value;
+});
+
+export function jsonResponse(entry: CachedResponse) {
+	return { decode: <TSchema extends Schema.Constraint>(schema: TSchema) => decodeJson(entry, schema) };
+}

package/src/rateLimits.ts

@@ -0,0 +1,56 @@
+import { Clock, DateTime, Effect } from "effect";
+import type { HttpClientResponse } from "effect/http";
+import type { GitHubRateLimited } from "./errors.ts";
+
+export interface RateLimitObservation {
+	readonly limit: number;
+	readonly remaining: number;
+	readonly reset: DateTime.Utc;
+	readonly resource: string;
+	readonly used: number;
+}
+
+export function rateLimits() {
+	const observations = new Map<string, RateLimitObservation>();
+	const blocked = new Map<string, GitHubRateLimited>();
+	const failures = new Map<string, number>();
+	const resources = new Map<string, string>();
+	function resource(path: string) {
+		return resources.get(path) ?? (path.startsWith("/search/") ? "search" : "core");
+	}
+	return {
+		blocked,
+		failures,
+		observations,
+		observe(response: HttpClientResponse.HttpClientResponse) {
+			const headers = response.headers;
+			const path = new URL(response.request.url).pathname;
+			const name = headers["x-ratelimit-resource"] ?? resource(path);
+			resources.set(path, name);
+			const values = ["limit", "remaining", "used", "reset"].map((key) => headers[`x-ratelimit-${key}`]);
+			if (values.every((value) => value !== undefined && Number.isFinite(Number(value)))) {
+				observations.set(name, {
+					limit: Number(headers["x-ratelimit-limit"]),
+					remaining: Number(headers["x-ratelimit-remaining"]),
+					reset: DateTime.makeUnsafe(Number(headers["x-ratelimit-reset"]) * 1000),
+					resource: name,
+					used: Number(headers["x-ratelimit-used"]),
+				});
+			}
+			return name;
+		},
+		resource,
+	};
+}
+
+export type RateLimits = ReturnType<typeof rateLimits>;
+
+export const failRateLimited = Effect.fnUntraced(function* (path: string, error: GitHubRateLimited, remaining: number | undefined) {
+	const fields = { path, remaining, resource: error.resource, retryAt: DateTime.formatIso(error.retryAt) };
+	yield* Effect.logWarning("GitHub rate limited", fields);
+	const span = yield* Effect.currentSpan.pipe(Effect.option);
+	if (span._tag === "Some") {
+		span.value.event("GitHub.rateLimited", yield* Clock.currentTimeNanos, fields);
+	}
+	return yield* error;
+});

package/src/representations.ts

@@ -0,0 +1,48 @@
+import { Effect, Stream } from "effect";
+import { HttpClient, HttpClientRequest, type HttpClientResponse } from "effect/http";
+import type { ServiceUnavailable } from "@shivaedev/platform/errors/taxonomy.ts";
+import { paginate } from "@shivaedev/platform/http-client/paginate.ts";
+import type { CachedResponse } from "#cache.ts";
+import { jsonResponse } from "#json.ts";
+import type { requests } from "#requests.ts";
+
+export function representations(apiUrl: string, request: ReturnType<typeof requests>, resource: (path: string) => string) {
+	function get(path: string, accept = "application/vnd.github+json") {
+		return HttpClientRequest.get(new URL(path, apiUrl).href, { headers: { Accept: accept } });
+	}
+	function readRepresentation(path: string) {
+		return Effect.map(request(get(path), 1024 * 1024), jsonResponse);
+	}
+	function listRepresentations(path: string, beforeRequest?: (resource: string) => Effect.Effect<void, ServiceUnavailable>) {
+		const entries = new WeakMap<HttpClientResponse.HttpClientResponse, CachedResponse>();
+		function fetchPage(input: HttpClientRequest.HttpClientRequest) {
+			return (beforeRequest?.(resource(new URL(input.url).pathname)) ?? Effect.void).pipe(
+				Effect.andThen(request(input, 1024 * 1024)),
+				Effect.map((entry) => {
+					entries.set(entry.response, entry);
+					return entry.response;
+				}),
+			);
+		}
+		const client = HttpClient.makeWith(
+			(effect: Effect.Effect<HttpClientRequest.HttpClientRequest>) => Effect.flatMap(effect, fetchPage),
+			Effect.succeed,
+		);
+		return Effect.succeed(
+			paginate(client, get(path)).pipe(
+				Stream.mapEffect((response) => Effect.fromNullishOr(entries.get(response))),
+				Stream.map(jsonResponse),
+			),
+		);
+	}
+	function writeRepresentation(method: "POST" | "PATCH", path: string, body: unknown) {
+		return HttpClientRequest.make(method)(new URL(path, apiUrl).href, { headers: { Accept: "application/vnd.github+json" } }).pipe(
+			HttpClientRequest.bodyJson(body),
+			Effect.flatMap((input) => request(input, 1024 * 1024)),
+			Effect.map(jsonResponse),
+		);
+	}
+	return { get, list: listRepresentations, read: readRepresentation, write: writeRepresentation };
+}
+
+export type Representations = Omit<ReturnType<typeof representations>, "get">;

package/src/requests.ts

@@ -0,0 +1,68 @@
+import { DateTime, Effect, Option, Redacted } from "effect";
+import { type HttpClient, HttpClientRequest } from "effect/http";
+import { readBoundedBody } from "@shivaedev/platform/http-client/body.ts";
+import { ResponseBodyTooLarge } from "@shivaedev/platform/http-client/errors.ts";
+import { type CachedResponse, responseCache } from "./cache.ts";
+import { GitHubTransportError } from "./errors.ts";
+import type { GitHubToken } from "./GitHubToken.ts";
+import { failRateLimited, type RateLimits } from "./rateLimits.ts";
+import { checkStatus, isUnchanged } from "./status.ts";
+
+export function requests(client: HttpClient.HttpClient, token: GitHubToken["Service"], rates: RateLimits) {
+	const cache = responseCache();
+	const accessToken = Effect.isEffect(token) ? token : Effect.succeed(token);
+	return Effect.fn("GitHub.request")(function* (input: HttpClientRequest.HttpClientRequest, limit: number) {
+		const path = new URL(input.url).pathname;
+		const resource = rates.resource(path);
+		const blocked = rates.blocked.get(resource);
+		if (blocked !== undefined && DateTime.isGreaterThan(blocked.retryAt, yield* DateTime.now)) {
+			return yield* failRateLimited(path, blocked, rates.observations.get(resource)?.remaining);
+		}
+		const key = `${input.url} ${input.headers.accept}`;
+		const cached = input.method === "GET" ? cache.get(key) : undefined;
+		const request = requestHeaders(input, cached, yield* accessToken);
+		const response = yield* client.execute(request).pipe(Effect.mapError(() => new GitHubTransportError({ path })));
+		const observedResource = rates.observe(response);
+		if (isUnchanged(response) && cached !== undefined) {
+			rates.failures.delete(observedResource);
+			rates.blocked.delete(observedResource);
+			if (cached.bytes.byteLength > limit) {
+				return yield* new ResponseBodyTooLarge({ limit });
+			}
+			return cached;
+		}
+		yield* checkStatus(response, observedResource, rates.failures.get(observedResource) ?? 0).pipe(
+			Effect.catchTag("HttpClientError", () => Effect.fail(new GitHubTransportError({ path }))),
+			Effect.catchTag("GitHubRateLimited", (error) => {
+				rates.blocked.set(error.resource, error);
+				rates.failures.set(error.resource, (rates.failures.get(error.resource) ?? 0) + 1);
+				return failRateLimited(path, error, rates.observations.get(error.resource)?.remaining);
+			}),
+		);
+		rates.failures.delete(observedResource);
+		rates.blocked.delete(observedResource);
+		const bytes = yield* readBoundedBody(response, limit).pipe(
+			Effect.catchTag("HttpClientError", () => Effect.fail(new GitHubTransportError({ path }))),
+		);
+		const entry: CachedResponse = { bytes, decoded: new Map(), response };
+		if (input.method === "GET" && response.headers.etag !== undefined) {
+			cache.set(key, entry);
+		}
+		return entry;
+	});
+}
+
+function requestHeaders(
+	input: HttpClientRequest.HttpClientRequest,
+	cached: CachedResponse | undefined,
+	token: Option.Option<Redacted.Redacted<string>>,
+) {
+	let request = HttpClientRequest.removeHeader(input, "if-none-match").pipe(HttpClientRequest.setHeader("X-GitHub-Api-Version", "2022-11-28"));
+	if (Option.isSome(token)) {
+		request = HttpClientRequest.setHeader(request, "Authorization", `Bearer ${Redacted.value(token.value)}`);
+	}
+	if (cached?.response.headers.etag !== undefined) {
+		request = HttpClientRequest.setHeader(request, "If-None-Match", cached.response.headers.etag);
+	}
+	return request;
+}

package/src/status.ts

@@ -0,0 +1,37 @@
+import { DateTime, Effect, Option, Schema } from "effect";
+import { HttpClient, type HttpClientResponse } from "effect/http";
+import { readBoundedText } from "@shivaedev/platform/http-client/body.ts";
+import { filterStatus } from "@shivaedev/platform/http-client/filterStatus.ts";
+import { parseRetryAfter } from "@shivaedev/platform/http-client/parseRetryAfter.ts";
+import { GitHubRateLimited } from "./errors.ts";
+
+export function isUnchanged(response: HttpClientResponse.HttpClientResponse) {
+	return response.status === 304;
+}
+
+export const checkStatus = Effect.fnUntraced(function* (response: HttpClientResponse.HttpClientResponse, resource: string, failures = 0) {
+	const { status, headers } = response;
+	if (status === 403 || status === 429) {
+		const limitedByHeaders = status === 429 || headers["x-ratelimit-remaining"] === "0" || headers["retry-after"] !== undefined;
+		const limitedByMessage = !limitedByHeaders && status === 403 && (yield* messageNamesRateLimit(response));
+		if (limitedByHeaders || limitedByMessage) {
+			const now = yield* DateTime.now;
+			const reset = Number(headers["x-ratelimit-reset"] ?? 0) * 1000;
+			const fallback =
+				headers["x-ratelimit-remaining"] === "0" && reset > DateTime.toEpochMillis(now)
+					? reset
+					: DateTime.toEpochMillis(now) + Math.min(15 * 60_000, 60_000 * 2 ** failures);
+			const retryAt = parseRetryAfter(headers["retry-after"], now) ?? DateTime.makeUnsafe(fallback);
+			return yield* new GitHubRateLimited({ resource, retryAt });
+		}
+	}
+	return yield* filterStatus(HttpClient.makeWith(() => Effect.succeed(response), Effect.succeed)).execute(response.request);
+});
+
+const Message = Schema.fromJsonString(Schema.Struct({ message: Schema.String }));
+
+const messageNamesRateLimit = Effect.fnUntraced(function* (response: HttpClientResponse.HttpClientResponse) {
+	const text = yield* readBoundedText(response, 64 * 1024);
+	const body = Schema.decodeUnknownOption(Message)(text);
+	return Option.isSome(body) && /rate limit/iu.test(body.value.message);
+});

package/src/stickyComments.ts

@@ -0,0 +1,41 @@
+import { Effect, Option, Schema, Stream } from "effect";
+import type { Representations } from "./representations.ts";
+
+export const PullRequestComment = Schema.Struct({
+	body: Schema.String,
+	id: Schema.Number,
+	user: Schema.NullOr(Schema.Struct({ login: Schema.String })),
+});
+
+export const StickyComment = Schema.Struct({
+	author: Schema.optional(Schema.String),
+	body: Schema.String,
+	marker: Schema.String,
+	number: Schema.Number,
+	owner: Schema.String,
+	repo: Schema.String,
+});
+
+const CommentBody = Schema.Struct({ body: Schema.String });
+
+export function stickyComments(client: Representations) {
+	return {
+		upsertStickyComment: Effect.fn("GitHub.upsertStickyComment")(function* (input: typeof StickyComment.Type) {
+			const { owner, repo, number, marker, body, author } = yield* Schema.decodeUnknownEffect(StickyComment)(input);
+			const hiddenMarker = `<!-- ${marker} -->`;
+			const root = `/repos/${owner}/${repo}/issues`;
+			const pages = yield* client.list(`${root}/${number}/comments`);
+			const existing = yield* pages.pipe(
+				Stream.mapEffect((page) => page.decode(Schema.Array(PullRequestComment))),
+				Stream.flatMap(Stream.fromIterable),
+				Stream.filter((comment) => comment.body.includes(hiddenMarker) && (author === undefined || comment.user?.login === author)),
+				Stream.runHead,
+			);
+			const payload = yield* Schema.encodeEffect(CommentBody)({ body: `${hiddenMarker}\n${body}` });
+			const response = yield* Option.isSome(existing)
+				? client.write("PATCH", `${root}/comments/${existing.value.id}`, payload)
+				: client.write("POST", `${root}/${number}/comments`, payload);
+			return yield* response.decode(PullRequestComment);
+		}),
+	};
+}

package/src/verifyWebhook.ts

@@ -0,0 +1,19 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { Effect, Redacted, Schema } from "effect";
+import { GitHubWebhookSignatureError } from "./errors.ts";
+
+export const verifyWebhook = Effect.fnUntraced(function* <TSchema extends Schema.Constraint>(
+	body: Uint8Array,
+	signature: string | undefined,
+	secret: Redacted.Redacted<string>,
+	schema: TSchema,
+) {
+	if (signature === undefined || !/^sha256=[0-9a-f]{64}$/u.test(signature)) {
+		return yield* new GitHubWebhookSignatureError();
+	}
+	const expected = createHmac("sha256", Redacted.value(secret)).update(body).digest();
+	if (!timingSafeEqual(expected, Buffer.from(signature.slice(7), "hex"))) {
+		return yield* new GitHubWebhookSignatureError();
+	}
+	return yield* Schema.decodeUnknownEffect(Schema.fromJsonString(schema))(new TextDecoder().decode(body));
+});