feat: implement bearer token verification for GitHub webhook to enhance security

.github/workflows/custom_build.yml

@@ -33,6 +33,7 @@ jobs:
     env:
       CONVEX_URL: ${{ inputs.convex_url }}
       BUILD_ID: ${{ inputs.build_id }}
+      CONVEX_BUILD_TOKEN: ${{ secrets.CONVEX_BUILD_TOKEN }}
     steps:
       - name: Setup status update helper
         shell: bash
@@ -47,6 +48,7 @@ jobs:
             fi
             curl -sSf -X POST "$CONVEX_URL/github-webhook" \
               -H "Content-Type: application/json" \
+              -H "Authorization: Bearer $CONVEX_BUILD_TOKEN" \
               -d "$payload" || true
           }
           EOF

convex/http.ts

@@ -11,9 +11,25 @@ http.route({
   path: '/github-webhook',
   method: 'POST',
   handler: httpAction(async (ctx, request) => {
-    const payload = await request.json()
+    // Verify bearer token
+    const buildToken = process.env.CONVEX_BUILD_TOKEN
+    if (!buildToken) {
+      return new Response('CONVEX_BUILD_TOKEN not configured', { status: 500 })
+    }
 
-    // Verify signature (TODO: Add HMAC verification)
+    const authHeader = request.headers.get('Authorization')
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return new Response('Missing or invalid Authorization header', {
+        status: 401,
+      })
+    }
+
+    const token = authHeader.substring(7) // Remove 'Bearer ' prefix
+    if (token !== buildToken) {
+      return new Response('Invalid token', { status: 401 })
+    }
+
+    const payload = await request.json()
 
     // Validate build_id and state are present
     if (!payload.build_id || !payload.state) {