feat(webhook): provider-agnostic receiver (push → warm), GitHub phase 1

[russellromney]

What

A built-in webhook receiver so a provider push auto-enqueues a sync (push → warm), reusing the existing build queue. No CI Action, no glue — the same warm-on-push the managed cloud gives you. Phase 1 = GitHub; structured so GitLab/Gitea are later trait impls.

Implements docs/WEBHOOKS.md (the design doc is the first commit on this branch).

provider push ─▶ POST /webhooks/{provider}
                   │  verify signature (HMAC over the RAW body, constant-time)
                   │  normalize payload → CanonicalEvent
                   ▼
                 enqueue_sync(state, repo, branch, cred)  ──▶ worker ──▶ clonepack
                   └─ the SAME enqueue path /sync uses

Changes

• webhook module (rust/src/webhook/): WebhookProvider trait (verify over raw body, parse → CanonicalEvent { kind, repo, ref_, after, default_branch, private }) + WebhookConfig (per-provider secret + optional allowlist).
• GitHub adapter: X-Hub-Signature-256 HMAC-SHA256 over the raw body, constant-time compare via subtle; X-GitHub-Event routing; parses push / branch-delete / ping.
• POST /webhooks/{provider} in server.rs, registered under the rate_limited layer but not auth_middleware (the HMAC is the auth). Reads raw bytes before JSON, looks up the ProviderInstance, verifies, parses, dispatches.
• enqueue_sync(...) factored out of sync_repo_inner and called from both /sync and the webhook — no duplicated build logic. The webhook drops the handle (fire-and-forget; responds 2xx fast).
• Branch-delete → RefStore::delete_branch (file + S3 + caching impls); never builds.
• Config: RIPCLONE_WEBHOOK_SECRET_<provider>, StaticBroker credential (queue: carry the per-request upstream token to the cross-process worker #55) for private clones, optional RIPCLONE_WEBHOOK_ALLOWLIST. No secret ⇒ 503, bad signature ⇒ 401.

Resolved open questions (recommended defaults)

• Allowlist: allow-all + a loud startup log; restrict with RIPCLONE_WEBHOOK_ALLOWLIST.
• Non-default branches: always warm the default branch; warm others only if already tracked.
• Multi-instance routing: {provider} is the ProviderInstance id; the secret is keyed per instance id.

Tests

Signature verify (valid / invalid / missing), GitHub parse, enqueue invoked on push, branch-delete cleanup, allowlist gating, no-secret ⇒ 503, tracked vs untracked non-default branch. cargo fmt --check + cargo clippy --all-targets -- -D warnings + the full release test suite (cargo test --release --all-targets --locked) are green.

Follow-ups

GitLab (X-Gitlab-Token) and Gitea/Forgejo (X-Gitea-Signature) adapters — each is one WebhookProvider impl plus a match arm in webhook::provider_for.

🤖 Generated with Claude Code