chrisns / repomanager / 24933553030 / 1

85%

master: 85%

push

github

Decode base64-encoded webhook bodies before HMAC verification

API Gateway HttpApi base64-encodes request bodies it deems binary, but
the @octokit/webhooks signature is computed over the raw decoded bytes.
Hashing the still-base64 payload made every signature mismatch and the
webhook silently 400'd for at least 7 days — so issue-tick events never
applied consented changes.

Honour event.isBase64Encoded before passing the payload to
verifyAndReceive.

158 of 208 branches covered (75.96%)

Branch coverage included in aggregate %.

378 of 409 relevant lines covered (92.42%)

9.11 hits per line