---
id: w2/m2/t003
title: HMAC-verified git webhook endpoint → redeploy on push
worker: worker2
status: done
estimate: 30m
depends_on: [w2/m2/t001]
---

## Objective

Close the push-to-deploy loop: a git host webhook, authenticated by HMAC signature, triggers a redeploy of the matching App.

## Context

- Roadmap item 2: "Wake activator + HMAC webhook — push-to-deploy from Git hosting."
- Webhook must verify the shared-secret HMAC signature (GitHub/Gitea `X-Hub-Signature-256` style) before acting — reject unsigned/mismatched payloads.
- Redeploy = bump the App's build revision (re-run build-from-git), reusing `Core.Deploy`'s projection.

## Steps

1. Add `POST /v1/webhooks/git` verifying HMAC-SHA256 against a per-app/shared secret (constant-time).
2. On a valid push event, resolve the target App and trigger a redeploy (bump revision / re-reconcile).

## Files

- `operator/internal/api/rest.go` (webhook handler) · `operator/internal/api/core.go`

## Acceptance criteria

- [ ] A push event with a valid signature redeploys the App; an invalid/absent signature is rejected (401) with no action.

## Out of scope

- Wake-on-request activator for hibernated apps (w1/m4 territory).
