tai42-webhook-verifier-github 0.2.2__tar.gz → 0.3.0__tar.gz

{tai42_webhook_verifier_github-0.2.2/src/tai42_webhook_verifier_github.egg-info → tai42_webhook_verifier_github-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tai42-webhook-verifier-github
-Version: 0.2.2
+Version: 0.3.0
 Summary: GitHub webhook-signature verifier plugin for the TAI ecosystem: a per-provider WebhookVerifier that checks each delivery's X-Hub-Signature-256 HMAC before the payload is dispatched.
 Author-email: tai42 <oss@tai42.ai>
 License-Expression: Apache-2.0
@@ -20,7 +20,7 @@ Requires-Python: >=3.13
 Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: tai42-contract<0.5,>=0.4
+Requires-Dist: tai42-contract<2,>=1.5
 Dynamic: license-file
 
 # tai42-webhook-verifier-github

{tai42_webhook_verifier_github-0.2.2 → tai42_webhook_verifier_github-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tai42-webhook-verifier-github"
-version = "0.2.2"
+version = "0.3.0"
 description = "GitHub webhook-signature verifier plugin for the TAI ecosystem: a per-provider WebhookVerifier that checks each delivery's X-Hub-Signature-256 HMAC before the payload is dispatched."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -27,7 +27,7 @@ dependencies = [
     # The pure interface contract this verifier registers through — the tai42_app
     # handle and the WebhookVerifier / WebhookVerificationError types. The HMAC
     # work is pure standard library (hmac / hashlib); no other tai-* dependency.
-    "tai42-contract>=0.4,<0.5",
+    "tai42-contract>=1.5,<2",
 ]
 
 [project.urls]
@@ -55,7 +55,7 @@ where = ["src"]
 include = ["tai42_webhook_verifier_github*"]
 
 [tool.setuptools.package-data]
-tai42_webhook_verifier_github = ["py.typed", "tai-plugin.yml"]
+tai42_webhook_verifier_github = ["py.typed", "tai-plugin.yml", "docs/*", "docs/images/*"]
 
 [tool.uv]
 cache-keys = [{ file = "pyproject.toml" }]

tai42_webhook_verifier_github-0.3.0/src/tai42_webhook_verifier_github/docs/index.mdx

@@ -0,0 +1,44 @@
+---
+title: "GitHub webhook verifier"
+description: "Bind the github webhook verifier to a hook topic and name the environment variable that holds the signing secret."
+---
+
+Registers the `github` webhook verifier. It authenticates an inbound delivery's
+`X-Hub-Signature-256` HMAC-SHA256, computed over the exact raw request body and keyed
+by the webhook's shared secret. Bind it to a hook topic to close that topic's door
+against unsigned deliveries.
+
+## Bind it to a topic
+
+A verifier is bound per hook topic. The binding names the environment variable that
+holds the signing secret through `config.secret_env` — the verifier looks that
+variable up at verify time, so the secret itself never lives in the manifest:
+
+```bash
+curl -X PUT .../api/hooks/topics/{topic}/verifier \
+  -d '{"verifier": "github", "config": {"secret_env": "GITHUB_WEBHOOK_SECRET"}}'
+```
+
+Set the same secret you configured on the GitHub webhook in that variable on every
+process that receives deliveries:
+
+```bash
+GITHUB_WEBHOOK_SECRET=...
+```
+
+The variable name is yours to choose — pick a distinct name per topic when one
+deployment verifies several GitHub webhooks with different secrets.
+
+## Behaviour
+
+- **Fails closed.** A missing `secret_env` key, a missing environment variable, or an
+  empty secret raises loudly rather than degrading to an unauthenticated door. A
+  malformed or mismatched signature is an ordinary verification failure.
+- **POST only.** The signature covers the raw body, so a door binding this verifier
+  rejects GET.
+- The comparison is constant-time, and the `sha256=` digest must be exactly 64 hex
+  characters.
+
+## See also
+
+- [Triggers and webhooks](/concepts/triggers-and-webhooks) — the verifier model and the built-in `shared_secret` verifier.

{tai42_webhook_verifier_github-0.2.2 → tai42_webhook_verifier_github-0.3.0}/src/tai42_webhook_verifier_github/tai-plugin.yml

@@ -2,7 +2,7 @@ spec_version: 1
 namespace: tai42
 name: webhook-verifier-github
 package: tai42-webhook-verifier-github
-version: 0.2.2
+version: 0.3.0
 description: >-
   GitHub webhook-signature verifier plugin for the TAI ecosystem: a per-provider
   WebhookVerifier that checks each delivery's X-Hub-Signature-256 HMAC before
@@ -10,7 +10,7 @@ description: >-
 license: Apache-2.0
 homepage: https://tai42.ai
 repository: https://github.com/tai42ai/tai42/tree/main/plugins/webhook-verifier-github
-contract: '>=0.4,<0.5'
+contract: '>=1.5,<2'
 categories:
   - webhooks
   - security

{tai42_webhook_verifier_github-0.2.2 → tai42_webhook_verifier_github-0.3.0/src/tai42_webhook_verifier_github.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tai42-webhook-verifier-github
-Version: 0.2.2
+Version: 0.3.0
 Summary: GitHub webhook-signature verifier plugin for the TAI ecosystem: a per-provider WebhookVerifier that checks each delivery's X-Hub-Signature-256 HMAC before the payload is dispatched.
 Author-email: tai42 <oss@tai42.ai>
 License-Expression: Apache-2.0
@@ -20,7 +20,7 @@ Requires-Python: >=3.13
 Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: tai42-contract<0.5,>=0.4
+Requires-Dist: tai42-contract<2,>=1.5
 Dynamic: license-file
 
 # tai42-webhook-verifier-github

{tai42_webhook_verifier_github-0.2.2 → tai42_webhook_verifier_github-0.3.0}/src/tai42_webhook_verifier_github.egg-info/SOURCES.txt

@@ -11,4 +11,5 @@ src/tai42_webhook_verifier_github.egg-info/PKG-INFO
 src/tai42_webhook_verifier_github.egg-info/SOURCES.txt
 src/tai42_webhook_verifier_github.egg-info/dependency_links.txt
 src/tai42_webhook_verifier_github.egg-info/requires.txt
-src/tai42_webhook_verifier_github.egg-info/top_level.txt
+src/tai42_webhook_verifier_github.egg-info/top_level.txt
+src/tai42_webhook_verifier_github/docs/index.mdx

tai42_webhook_verifier_github-0.3.0/src/tai42_webhook_verifier_github.egg-info/requires.txt

@@ -0,0 +1 @@
+tai42-contract<2,>=1.5

tai42_webhook_verifier_github-0.2.2/src/tai42_webhook_verifier_github.egg-info/requires.txt

@@ -1 +0,0 @@
-tai42-contract<0.5,>=0.4