ci-webhook.py

@@ -29,17 +29,11 @@ SECRET = CONFIG.get("webhook_secret", "").encode()
 
 
 def verify_signature(payload: bytes, signature: str) -> bool:
-    """Verify Gitea webhook HMAC signature.
-
-    Gitea sends X-Gitea-Signature as a bare hex digest. GitHub-style senders
-    prefix it with "sha256=". Accept either form — the HMAC comparison itself
-    is unchanged, so this does not loosen verification.
-    """
+    """Verify Gitea webhook HMAC signature."""
     if not SECRET:
         return True  # No secret configured — accept all
     expected = hmac.new(SECRET, payload, hashlib.sha256).hexdigest()
-    provided = signature[len("sha256="):] if signature.startswith("sha256=") else signature
-    return hmac.compare_digest(expected, provided)
+    return hmac.compare_digest(f"sha256={expected}", signature)
 
 
 class WebhookHandler(BaseHTTPRequestHandler):