📦 GitHub Webhooks Decoded
Why your serverless listener isn’t rotating civic hashtags or verifying GitHub events…
🛠️ What’s Missing
❌ No logic to extract or rotate hashtags
❌ No storage or update mechanism
❌ No raw body capture for HMAC integrity (needed on platforms like Vercel)
🔍 Hashtag Rotation Logic
Your listener doesn’t parse commit messages, issue titles, or PR descriptions for hashtags. There’s no function to:
- Extract
#tagsfrom payloads - Store them in a rotating queue or database
- Update civic dashboards or rolling tickers
✅ Fix: Add a parser that scans
req.body for hashtags and pushes them to a rotation module or Redis queue. 📦 Storage and Update Mechanism
Even if hashtags are extracted, they’re not saved anywhere. No database, cache, or file system is used to persist or rotate them across sessions.
✅ Fix: Use a lightweight store (e.g., Redis, Supabase, or Firebase) to log hashtags and rotate them every X minutes.
🔐 Raw Body Capture for HMAC Integrity
Platforms like Vercel parse the body before you can hash it, breaking HMAC verification. GitHub signs the raw payload, so you must capture it before any parsing.
// Example for Vercel export const config = { api: { bodyParser: false, }, }; import { buffer } from 'micro'; const rawBody = await buffer(req); ✅ Fix: Use
req.rawBody or a custom body parser middleware to preserve the raw string for HMAC comparison. 🧭 Civic Impact
- 🚫 Your dashboard won’t reflect trending civic hashtags
- 🛑 You risk spoofed or tampered GitHub events
- 📉 Your API loses audit-grade integrity
✅ With these fixes, you get verified, rotating civic signals and build public confidence in your infrastructure.
📚 Glossary (Kid-Friendly)
| Term | Meaning |
|---|---|
Webhook | A message GitHub sends when something happens |
Hashtag | A keyword with # used to tag topics |
Rotation | Changing what’s shown every few seconds or minutes |
HMAC | A secret math check to prove a message is real |
Raw Body | The untouched message before any changes |
Serverless | Code that runs online without managing a physical server |
No comments:
Post a Comment