Split GET /trigger/eval into a two-step flow: GET renders a confirmation
page with a "Run Evaluation" button, POST performs the actual dispatch.
This prevents GitHub's link unfurling bot from auto-triggering evals
when it fetches the URL from PR comments.
The POST handler polls for the Actions run URL after dispatch and opens
it in a new tab via window.open, with a fallback link if the run isn't
found within 5 seconds.
Add GET /trigger/eval route to eval-webhook with HMAC-signed URLs.
The showcase_eval_check.yml workflow now posts a bot comment with a
clickable "Run Evaluation" link. Clicking triggers the eval and
redirects back to the PR. The link is signed so it can't be forged.
- Add buffer length check before timingSafeEqual to prevent RangeError
on missing/malformed X-Hub-Signature-256 headers
- Switch Dockerfile from pnpm to npm with package-lock.json (pnpm
lockfile lives at monorepo root, not in the package directory)
Hono web server that receives check_run.requested_action webhooks from
GitHub, authenticates as the devops bot, updates the Check Run to
in_progress, and dispatches showcase_eval.yml via workflow_dispatch.
Includes GHCR build workflow and pnpm workspace registration.
Jordan Ritter