Accept Gitea webhook signature format

app/main.py

@@ -48,13 +48,18 @@ def verify_signature(body: bytes, signature: str | None):
     if not signature:
         raise HTTPException(status_code=401, detail="Missing signature")
 
-    expected = "sha256=" + hmac.new(
+    digest = hmac.new(
         WEBHOOK_SECRET.encode("utf-8"),
         body,
         hashlib.sha256
     ).hexdigest()
 
-    if not hmac.compare_digest(expected, signature):
+    valid_signatures = {
+        digest,
+        f"sha256={digest}",
+    }
+
+    if not any(hmac.compare_digest(signature, valid) for valid in valid_signatures):
         raise HTTPException(status_code=401, detail="Invalid signature")