build: implement security verification

package.json

@@ -20,7 +20,8 @@
     "url": "git+/~https://github.com/open-sauced/catsup.git"
   },
   "engines": {
-    "node": ">= 16"
+    "node": ">= 16.7.0",
+    "npm": ">= 8.0.0"
   },
   "scripts": {
     "push": "npx @open-sauced/conventional-commit",

src/index.js

@@ -68,16 +68,15 @@ async function handleRequest(request) {
     });
   }
 
-  const id = request.headers.get('x-github-delivery');
-  const name = request.headers.get('x-github-event');
-  const payload = await request.json();
-
   try {
-    await app.webhooks.receive({
-      id,
-      name,
-      payload,
-    });
+    await app.webhooks
+      .verifyAndReceive({
+        id: request.headers.get('x-github-delivery'),
+        name: request.headers.get('x-github-event'),
+        signature: request.headers.get('x-hub-signature-256')
+          .replace(/sha256=/, ''),
+        payload: (await request.json()),
+      });
 
     return new Response('{ "ok": true }', {
       headers: { 'content-type': 'application/json' },