Add GitHub webhook receiver

app/config.py

@@ -101,6 +101,14 @@ class AIConfig:
     page_extract: AIPageExtractConfig = field(default_factory=AIPageExtractConfig)
 
 
+@dataclass(slots=True)
+class GitHubWebhookConfig:
+    enabled: bool = False
+    host: str = "0.0.0.0"
+    port: int = 8080
+    secret: str | None = None
+
+
 @dataclass(slots=True)
 class AppConfig:
     api_id: int | None
@@ -108,6 +116,7 @@ class AppConfig:
     session_dir: Path
     accounts: list[AccountConfig]
     ai: AIConfig | None = None
+    github_webhook: GitHubWebhookConfig = field(default_factory=GitHubWebhookConfig)
 
 
 def _read_json_file(path: Path) -> dict[str, Any]:
@@ -298,6 +307,52 @@ def _parse_page_extract_config(raw_ai: dict[str, Any]) -> AIPageExtractConfig:
     )
 
 
+def _parse_github_webhook_config(raw: Any) -> GitHubWebhookConfig:
+    raw_config = _parse_mapping(raw, field_name="github_webhook")
+
+    enabled = _parse_bool(
+        raw_config.get("enabled", False),
+        field_name="github_webhook.enabled",
+    )
+    host = str(raw_config.get("host", "0.0.0.0") or "0.0.0.0").strip()
+    if not host:
+        raise ValueError("github_webhook.host is required")
+
+    port = _parse_int(raw_config.get("port", 8080), field_name="github_webhook.port")
+    if port < 1 or port > 65535:
+        raise ValueError("github_webhook.port must be between 1 and 65535")
+
+    raw_secret = raw_config.get("secret")
+    secret = str(raw_secret).strip() if raw_secret is not None else None
+    secret = secret or None
+
+    if os.environ.get("GITHUB_WEBHOOK_ENABLED") is not None:
+        enabled = _parse_bool(
+            os.environ["GITHUB_WEBHOOK_ENABLED"],
+            field_name="GITHUB_WEBHOOK_ENABLED",
+        )
+    if os.environ.get("GITHUB_WEBHOOK_HOST") is not None:
+        host = os.environ["GITHUB_WEBHOOK_HOST"].strip()
+        if not host:
+            raise ValueError("GITHUB_WEBHOOK_HOST is required")
+    if os.environ.get("GITHUB_WEBHOOK_PORT") is not None:
+        port = _parse_int(os.environ["GITHUB_WEBHOOK_PORT"], field_name="GITHUB_WEBHOOK_PORT")
+        if port < 1 or port > 65535:
+            raise ValueError("GITHUB_WEBHOOK_PORT must be between 1 and 65535")
+    if os.environ.get("GITHUB_WEBHOOK_SECRET") is not None:
+        secret = os.environ["GITHUB_WEBHOOK_SECRET"].strip() or None
+
+    if enabled and not secret:
+        raise ValueError("github_webhook.secret is required when github_webhook.enabled is true")
+
+    return GitHubWebhookConfig(
+        enabled=enabled,
+        host=host,
+        port=port,
+        secret=secret,
+    )
+
+
 def _parse_accounts(raw_accounts: Any, *, default_api_id: int | None, default_api_hash: str | None, default_session_dir: Path) -> list[AccountConfig]:
     if raw_accounts is None:
         return []
@@ -552,6 +607,7 @@ def load_app_config(root: Path) -> AppConfig:
     )
 
     ai = _parse_ai_config(raw.get("ai"), root=root)
+    github_webhook = _parse_github_webhook_config(raw.get("github_webhook"))
 
     if not accounts:
         raise ValueError("At least one account must be configured")
@@ -572,4 +628,5 @@ def load_app_config(root: Path) -> AppConfig:
         session_dir=session_dir,
         accounts=accounts,
         ai=ai,
+        github_webhook=github_webhook,
     )