[arnaudveron]

Goal

Answer the GitHub ping event with 200. GitHub sends it to the webhook URL when a hook is created or activated, and today the receiver answers 400, so the new hook shows a failed delivery.

Cause

connexion validates the request before the controller (and @verify) runs:

• the X-GitHub-Event header enum only accepts the event of the path (pull_request, push or release);
• the ping body is validated against the event schema ('action' is a required property).

Changes

• swagger/github.yaml: ping added to the X-GitHub-Event enum of the 3 paths. Each request body is now oneOf: [<Event>, Ping], with a new Ping schema (zen and hook_id required).
• controllers/events.py: a ping event answers 200 {"message": "pong", "zen": ..., "hook_id": ...}. A ping body sent with another event header is rejected with 400. Other events take the same path as before. The signature is still checked by @verify.

Trade-off: an invalid pull_request/push/release payload still gets a 400, but the message is the generic oneOf one instead of naming the missing property. The alternative is a Flask before_request hook that answers ping before the validation. It keeps the detailed messages, but it is outside the OpenAPI spec and duplicates the signature check.

Tested

Local image built from this branch, SECRET set, requests signed in sha1 and sha256:

request	before	after
signed ping on /pullrequest, /release, /push	400	200 pong
ping with a bad signature	400	403
signed / badly signed pull_request	200 / 403	200 / 403
pull_request with an invalid action	400	400 (generic message)
ping body with X-GitHub-Event: pull_request	400	400
ping without X-Hub-Signature	400	400

Independent of #16 (skip draft pull requests).

Not in this PR, possible follow-ups:

• signature.py only checks the sha1 X-Hub-Signature, and compares with != instead of hmac.compare_digest.
• context/github_release.py raises KeyError (500) when release.author is missing.