fix(webhooks): compare signatures in constant time

[cbetta]

Compares webhook signatures in constant time.

- if expected_signature not in signatures:
+ expected = expected_signature.encode()
+ if not any(hmac.compare_digest(expected, signature.encode()) for signature in signatures):

The old comparison stops at the first character that differs, so how long a rejection takes shows how much of a guessed signature was right. Rotation still works: any one of the comma-separated signatures can match. Bytes, because compare_digest raises TypeError on non-ASCII strings.

🤖 Generated with Claude Code

[github-actions]

🧪 Test coverage

Metric	Value
Endpoints reached (HTTP)	120 / 120 (100.0%)

✅ Every endpoint operation was reached by a real request.

_{Endpoint reach is measured from HTTP requests actually sent by the suite (see tests/utils/client.py). See TESTING.md.}

[Copilot]

Copilot review overview

🟡 Changes recommended

Non-ASCII signatures raise an unexpected TypeError and prevent later valid signatures from matching.

Review effort: Balanced
Findings: 1

Open (1)

• Handle non-ASCII signature candidates before compare_digest · New

What changed in this PR

Hardens webhook verification against timing leaks while preserving support for rotated signatures.

Changes:

• Uses hmac.compare_digest for signature comparisons.
• Adds tests for a later valid signature and a near-match rejection.

File	Description
tests/​test_webhooks.py	Adds signature acceptance and rejection tests.
src/​gr4vy/​webhooks.py	Replaces membership checking with constant-time comparisons.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused change preserves existing behavior, resolves the prior non-ASCII issue, and includes regression coverage.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Handle non-ASCII signature candidates before compare_digest