feat: add GitHub webhook endpoint for automatic CI failure task creation

Adds POST /api/webhooks/github that receives check_run and workflow_run
events and creates a Claudomator task to investigate and fix the failure.

- Config: new webhook_secret and [[projects]] fields in config.toml
- HMAC-SHA256 validation when webhook_secret is configured
- Ignores non-failure events (success, skipped, etc.) with 204
- Matches repo name to configured project dirs (case-insensitive)
- Falls back to single project when no name match found
- 11 new tests covering all acceptance criteria

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 47 insertions, 0 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 16a48b4..2cb37a8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -119,6 +119,53 @@ After each task execution, Claudomator extracts git diff statistics from the exe
 
 **Frontend display:** `web/app.js` renders a `.changestats-badge` on COMPLETED/READY task cards and in execution history rows.
 
+## GitHub Webhook Integration
+
+Claudomator can automatically create tasks when CI builds fail on GitHub.
+
+### Endpoint
+
+`POST /api/webhooks/github`
+
+Accepts `check_run` and `workflow_run` events from GitHub. Returns `{"task_id": "..."}` (200) when a task is created, or 204 when the event is ignored.
+
+### Config (`~/.claudomator/config.toml`)
+
+```toml
+# Optional: HMAC-SHA256 secret set in the GitHub webhook settings.
+# If omitted, signature validation is skipped.
+webhook_secret = "your-github-webhook-secret"
+
+# Projects for matching incoming webhook repository names to local directories.
+[[projects]]
+name = "myrepo"
+dir  = "/workspace/myrepo"
+
+[[projects]]
+name = "other-service"
+dir  = "/workspace/other-service"
+```
+
+### Matching logic
+
+The handler matches the webhook's `repository.name` against each project's `name` and the basename of its `dir` (case-insensitive substring). If no match is found and only one project is configured, that project is used as a fallback.
+
+### GitHub webhook setup
+
+In your GitHub repository → Settings → Webhooks → Add webhook:
+- **Payload URL:** `https://<your-claudomator-host>/api/webhooks/github`
+- **Content type:** `application/json`
+- **Secret:** value of `webhook_secret` in config (or leave blank if not configured)
+- **Events:** select *Workflow runs* and *Check runs*
+
+### Task creation
+
+A task is created for:
+- `check_run` events with `action: completed` and `conclusion: failure`
+- `workflow_run` events with `action: completed` and `conclusion: failure` or `timed_out`
+
+Tasks are tagged `["ci", "auto"]`, capped at $3 USD, and use tools: Read, Edit, Bash, Glob, Grep.
+
 ## ADRs
 
 See `docs/adr/001-language-and-architecture.md` for the Go + SQLite + WebSocket rationale.