Build a GitHub secret scanning phone alert for exposed credentials

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyGitHubSignature(rawBody, signature, webhookSecret) {
  if (!signature?.startsWith("sha256=") || !webhookSecret) return false;
  const expected = createHmac("sha256", webhookSecret).update(rawBody).digest();
  const received = Buffer.from(signature.slice(7), "hex");
  return expected.length === received.length && timingSafeEqual(expected, received);
}

export function shouldEscalate(headers, payload, productionRepos) {
  const event = headers.get("x-github-event");
  const delivery = headers.get("x-github-delivery");
  const repo = payload.repository?.full_name;
  const alert = payload.alert;

  return Boolean(
    delivery &&
    event === "secret_scanning_alert" &&
    payload.action === "created" &&
    alert?.state === "open" &&
    repo && productionRepos.has(repo)
  );
}

// Call verifyGitHubSignature(rawBody, signature, secret) before this gate.
// Build the call from safe allowlisted fields. Never include the secret value.