Crate tatara_github_watcher 

tatara-github-watcher — GitHub webhook receiver.

Watches an entire GitHub organization (or several) by receiving org-level webhooks and translating PR + push + branch events into EphemeralAllocation CRs that the pool reconciler routes to a matching EphemeralPool.

Modules:

• verify — HMAC-SHA256 signature verification (GitHub’s X-Hub-Signature-256 header). Constant-time comparison.
• event — typed GitHub event shapes (just the fields we read).
• allocation_factory — typed translator: GitHub PR event → EphemeralAllocation spec. Pure function, fully unit-tested.
• handler — axum HTTP handler that verifies signature, dispatches on event type, applies via kube-rs.
• config — typed config struct loaded from env / CLI flags.

Re-exports

pub use allocation_factory::allocation_name;

pub use allocation_factory::build_allocation;

pub use allocation_factory::FactoryError;

pub use config::WatcherConfig;

pub use event::EventKind;

pub use event::PrAction;

pub use event::PullRequestEvent;

pub use event::PushEvent;

pub use verify::verify_signature;

pub use verify::VerifyError;

Modules

allocation_factory

Translate a GitHub event into an EphemeralAllocation spec.

config

Typed runtime config for the watcher.

event

Typed GitHub event shapes — only the fields the watcher reads. Everything else is intentionally dropped (forward-compatible — any new GitHub field doesn’t break our deserialization).

handler

axum HTTP handler — verify signature, dispatch on event kind, apply resulting Allocation via kube-rs.

verify

HMAC-SHA256 verification of GitHub’s X-Hub-Signature-256 header.