fix(showcase): CR fixes — timingSafeEqual buffer length + Dockerfile npm lockfile

- Add buffer length check before timingSafeEqual to prevent RangeError
  on missing/malformed X-Hub-Signature-256 headers
- Switch Dockerfile from pnpm to npm with package-lock.json (pnpm
  lockfile lives at monorepo root, not in the package directory)

Author: jpr5

showcase/eval-webhook/Dockerfile

@@ -2,23 +2,19 @@ FROM node:22-slim AS builder
 
 WORKDIR /app
 
-RUN corepack enable && corepack prepare pnpm@latest --activate
-
-COPY package.json pnpm-lock.yaml ./
-RUN pnpm install --frozen-lockfile
+COPY package.json package-lock.json ./
+RUN npm ci
 
 COPY tsconfig.json ./
 COPY src/ ./src/
-RUN pnpm build
+RUN npm run build
 
 FROM node:22-slim
 
 WORKDIR /app
 
-RUN corepack enable && corepack prepare pnpm@latest --activate
-
-COPY package.json pnpm-lock.yaml ./
-RUN pnpm install --frozen-lockfile --prod
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
 
 COPY --from=builder /app/dist ./dist
 

showcase/eval-webhook/package-lock.json

@@ -18,7 +18,10 @@ function verifySignature(payload: string, signature: string): boolean {
   const expected =
     "sha256=" +
     crypto.createHmac("sha256", WEBHOOK_SECRET).update(payload).digest("hex");
-  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
+  const expectedBuf = Buffer.from(expected);
+  const signatureBuf = Buffer.from(signature);
+  if (expectedBuf.length !== signatureBuf.length) return false;
+  return crypto.timingSafeEqual(expectedBuf, signatureBuf);
 }
 
 function getOctokit(): Octokit {