granthi-review v1: estate-wide AI code review service

Webhook-driven central review service for Granthi forges: HMAC-verified push/pull_request webhooks, per-repo serialization with global LLM concurrency 1, shre-router powered rubric review (8 axes, strict JSON, tolerant extractor + retry), commit statuses + PR scorecard comments, sqlite attribution ledger with Co-Authored-By trailer parsing, per-repo HTML history dashboard, nightly per-agent digests, fail-open-with- visibility when the router is unavailable. Posture: BLOCK on confirmed critical/high correctness+security findings; admin merge is the human override. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-08-18 23:24:27 -04:00
commit 9ffd810943
22 changed files with 1255 additions and 0 deletions
@@ -0,0 +1,62 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+
+export function verifySignature(rawBody, signature, secret) {
+  if (!secret) return false;
+  if (!signature) return false;
+  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
+  const a = Buffer.from(expected, 'utf8');
+  const b = Buffer.from(String(signature), 'utf8');
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+const ZERO_SHA = /^0+$/;
+
+// Turn a Gitea webhook (event header + payload) into a review job, or null if
+// the event is not reviewable.
+export function jobFromWebhook(event, payload) {
+  if (event === 'push') {
+    const after = payload.after;
+    if (!after || ZERO_SHA.test(after)) return null; // branch delete
+    const [owner, repo] = String(payload.repository?.full_name || '').split('/');
+    if (!owner || !repo) return null;
+    const commits = Array.isArray(payload.commits) ? payload.commits : [];
+    if (commits.length === 0) return null; // e.g. tag push / empty
+    return {
+      event: 'push',
+      owner, repo,
+      sha: after,
+      ref: payload.ref,
+      before: payload.before,
+      prIndex: null,
+      prTitle: null,
+      pusher: payload.pusher?.username || payload.pusher?.login || null,
+      authors: dedupe(commits.map(c => c.author?.name || c.author?.email).filter(Boolean)),
+      commitShas: commits.map(c => c.id).filter(Boolean),
+      commitMessages: commits.map(c => c.message || '')
+    };
+  }
+  if (event === 'pull_request') {
+    const action = payload.action;
+    if (!['opened', 'synchronize', 'synchronized', 'reopened'].includes(action)) return null;
+    const pr = payload.pull_request;
+    if (!pr) return null;
+    const [owner, repo] = String(payload.repository?.full_name || '').split('/');
+    if (!owner || !repo) return null;
+    return {
+      event: `pull_request/${action}`,
+      owner, repo,
+      sha: pr.head?.sha,
+      ref: pr.head?.ref,
+      before: null,
+      prIndex: pr.number,
+      prTitle: pr.title || null,
+      pusher: payload.sender?.username || payload.sender?.login || null,
+      authors: dedupe([pr.user?.username || pr.user?.login].filter(Boolean)),
+      commitShas: [pr.head?.sha].filter(Boolean),
+      commitMessages: [pr.title || '', pr.body || '']
+    };
+  }
+  return null;
+}
+
+function dedupe(a) { return [...new Set(a)]; }