Secret scanning webhook
GitHub's secret-scanning partner endpoint.
packages/api/src/webhooks/secret-scanning.controller.ts by packages/docs/tools/generate-reference.mjs. Do not edit by hand: src/reference.spec.ts regenerates it and fails on a difference.POST /v1/webhooks/github/secret_scanning -- GitHub's secret-scanning
partner endpoint (report section 8.2).
Several routes here are unauthenticated -- sign-up, log-in, the health
probes, the JWKS. This is the only one that revokes a credential without
holding one. What authorises it is the ECDSA signature over the raw body,
and that check runs before anything else: before the JSON is parsed,
before a token is hashed, before a connection is borrowed. The body reaches
this handler as a Buffer precisely so that is true rather than merely
intended -- app.factory.ts leaves this one route's payload unparsed, for
the same reason GitHub's own documentation gives (a re-serialised body has
different bytes and would not verify).
Every token is handled in its own transaction, so one that fails does not undo another's revocation, and a failure answers 5xx rather than labelling a token we did not act on -- GitHub redelivers, and every action here is idempotent.
POST /v1/webhooks/github/secret_scanning
Answers 200 on success.
Authentication.
- No credential.