track: github-app-webhook-20260530 — GitHub App + webhook + Cloudflare tunnel transport

[amondnet]

Track: github-app-webhook-20260530 (type: feature)

Add a real-time, webhook-based inbound transport to the GitHub channel plugin (plugins/github/server.ts) as an opt-in alternative to the existing PAT + REST polling.

Scope

• GitHub App auth (app id / private key / installation id) for webhook mode; PAT + polling stays the default.
• Local webhook receiver with X-Hub-Signature-256 verification, handling issue_comment events (parity with current polling).
• Cloudflare tunnel — quick (TryCloudflare, default) and named (configurable) modes; channel spawns cloudflared, obtains the public URL, and auto-registers it as the App webhook target.
• Reuses the existing mention-match → sender-gating → dedup → emit pipeline and outbound tools.

Transport selection

CLAUDE_GITHUB_TRANSPORT=poll|webhook (defaults to poll — non-breaking).

Out of scope

• Cloudflare deployment (hosted Worker/service) — future follow-up track.
• Assisted App Manifest creation; PR review (diff-line) comments; issue/PR "opened" body mentions.

---

Spec & plan: .please/docs/tracks/active/github-app-webhook-20260530/

[amondnet]

Implementation complete ✅

All 13 tasks across 4 phases implemented on feat/github-app-webhook-20260530 (draft PR #14).

• Phase 1 — Foundation: transport selector, App-credential config, App-installation Octokit factory
• Phase 2 — Webhook inbound: HMAC-SHA256 signature verification, issue_comment → message mapper, signed Bun.serve receiver reusing the poll pipeline (mention → gating → dedup → emit)
• Phase 3 — Tunnel & registration: cloudflared quick + named lifecycle, webhook-URL auto-registration via the App
• Phase 4 — Integration & docs: runServer transport branch (poll stays default, non-breaking), README/README.ko/configure-skill/tech-stack docs

Tests: 112 pass / 0 fail; new domain logic unit-tested, lint + typecheck clean for the plugin.

Cloudflare deployment (hosted Worker) remains a future follow-up per spec.