From e7c2a373c9bd7bcdd47020e2a0b9af71c7fdfed1 Mon Sep 17 00:00:00 2001
From: Alex Metelli <alex-metelli@gmx.com>
Date: Thu, 7 May 2026 14:37:26 +0800
Subject: [PATCH] Specify webhook signature buffer encoding

---
 packages/github/src/index.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/github/src/index.ts b/packages/github/src/index.ts
index 26b75df..f67b8ef 100644
--- a/packages/github/src/index.ts
+++ b/packages/github/src/index.ts
@@ -556,8 +556,8 @@ export function verifyWebhookSignature(options: {
 }): boolean {
   const expected = `sha256=${createHmac("sha256", options.secret).update(options.payload).digest("hex")}`;
   const actual = options.signature256;
-  const expectedBuffer = Buffer.from(expected);
-  const actualBuffer = Buffer.from(actual);
+  const expectedBuffer = Buffer.from(expected, "utf8");
+  const actualBuffer = Buffer.from(actual, "utf8");
   return (
     expectedBuffer.length === actualBuffer.length &&
     timingSafeEqual(expectedBuffer, actualBuffer)