[FEAT] Add webhook endpoint for GitHub push events to auto-trigger metric refresh

[Priyanshu-byte-coder]

Summary

Currently, metrics only update when the user manually syncs or the dashboard loads. With a GitHub webhook, the dashboard could auto-refresh within seconds of a push event — no manual sync needed.

Expected Behaviour

• POST /api/webhooks/github receives push events from GitHub
• Verifies signature (HMAC-SHA256 with GITHUB_WEBHOOK_SECRET)
• Extracts pusher login, triggers metric re-computation for that user
• Invalidates cached data for the user
• If SSE is active (issue [GOOD FIRST ISSUE] Add empty state to StreakTracker when no contribution data #204), pushes a refresh event to the connected client

Implementation Notes

• GitHub App or per-repo webhook setup (document in README)
• Verify: crypto.timingSafeEqual(sig, computedSig)
• Queue re-computation rather than doing it inline (use Vercel background functions or a Supabase Edge Function)
• Respond 200 immediately, process async

GSSoC Info

• Difficulty: Advanced — 55 pts
• Area: Infrastructure / Real-time

[srinidhi-2006-bit]

Hi @Priyanshu-byte-coder

I’m contributing under GSSoC’26 and I would like to work on this issue.

I understand that the task involves implementing a secure GitHub webhook endpoint for push events, including HMAC-SHA256 signature verification, async metric refresh handling, cache invalidation, and optional SSE-based real-time updates.

I’ll ensure the implementation follows proper security and performance practices while keeping the webhook processing lightweight and scalable.

Looking forward to contributing to DevTrack

[Harsh-Codes-77]

Hi @Priyanshu-byte-coder
I’m contributing under GSSoC’26 and I would like to work on this issue.

[maria-453]

Hi @Priyanshu-byte-coder , I’d like to work on this issue under GSSOC26.

I’m interested in the backend/infrastructure side of the project, and this issue looks like a great opportunity to contribute. My plan is to:

• Create the /api/webhooks/github endpoint
• Verify GitHub webhook signatures using HMAC-SHA256
• Extract the pusher information and trigger async metric recomputation
• Invalidate cached user data
• Explore SSE refresh integration if applicable

I’ll also document the webhook setup process in the README.

Please assign this issue to me if it’s available. Thanks!

[Nishukhurana]

/assign

[devendra-w]

Hey @Priyanshu-byte-coder, I believe this issue is already covered by my PR #299 which implements POST /api/webhooks/github with HMAC-SHA256 signature verification, GITHUB_WEBHOOK_SECRET, and SSE integration. Could you take a look and confirm if this issue can be closed once that PR is merged?

[Nikkiraj4]

/assign gssoc'26

[tech-dipesh]

/assign gssoc 2026