verifyGithubSignature (responsibilities/signatures.ts)

Utility functions to verify webhook signatures from GitHub, Linear, Sentry, PagerDuty, and generic HMAC-based webhooks.

// Source: https://github.com/CopilotKit/OpenBot | License: MIT | Copyright 2026 CopilotKit
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Each vendor's own documented signature scheme, over the raw request bytes, compared in constant
 * time. Nothing here parses JSON before the signature is checked except where the vendor itself
 * signs a parsed form (Sentry signs `JSON.stringify(body)`).
 *
 * Sources:
 *  - GitHub: `X-Hub-Signature-256: sha256=<hex HMAC-SHA256(secret, raw body)>`.
 *  - Linear: `Linear-Signature: <hex HMAC-SHA256(signing secret, raw body)>`; payload
 *    `webhookTimestamp` (ms) within one minute (https://linear.app/developers/webhooks).
 *  - Sentry: `Sentry-Hook-Signature: <hex HMAC-SHA256(client secret, JSON.stringify(body))>`
 *    (https:/

... (truncated -- full source via MCP)