feat: refresh MPS cache from signed webhook

[guillaumegay13]

Summary

• add a public GitHub webhook endpoint for modelparameters.dev pull request merge events
• verify GitHub X-Hub-Signature-256 using MODEL_PARAMETERS_WEBHOOK_SECRET before refreshing the MPS cache
• document webhook setup and keep the daily 4am refresh as fallback

Validation

• npm test --workspace=packages/backend -- src/routing/__tests__/model-parameters-webhook.controller.spec.ts src/config/app.config.spec.ts src/routing/routing-core/__tests__/provider-param-spec.service.spec.ts --runInBand
• cd packages/backend && npx tsc --noEmit
• npx eslint packages/backend/src/routing/model-parameters-webhook.controller.ts packages/backend/src/routing/__tests__/model-parameters-webhook.controller.spec.ts packages/backend/src/config/app.config.ts packages/backend/src/config/app.config.spec.ts packages/backend/src/main.ts packages/backend/src/routing/routing.module.ts
• npx prettier --check packages/backend/src/routing/model-parameters-webhook.controller.ts packages/backend/src/routing/__tests__/model-parameters-webhook.controller.spec.ts packages/backend/src/config/app.config.ts packages/backend/src/config/app.config.spec.ts packages/backend/src/main.ts packages/backend/src/routing/routing.module.ts docs/model-parameters-schema.md .changeset/quiet-pens-shake.md
• npm run build --workspace=packages/shared
• npm run build --workspace=packages/backend
• npm run lint (warnings only, existing)
• npm run build
• git diff --check

Runtime setup

Set MODEL_PARAMETERS_WEBHOOK_SECRET in Manifest and use the same value as the GitHub webhook secret on mnfst/modelparameters.dev. Configure the webhook URL as /api/v1/webhooks/model-parameters/github and subscribe to Pull request events.

---

Summary by cubic

Adds a signed GitHub webhook to refresh the Model Parameters Schema cache after PRs are merged in mnfst/modelparameters.dev. Busts CDN cache so refreshes apply immediately; the daily 4am refresh remains as fallback.

• New Features

  • Public endpoint: POST /api/v1/webhooks/model-parameters/github verifies X-Hub-Signature-256 with MODEL_PARAMETERS_WEBHOOK_SECRET.
  • Refreshes only for pull_request events that are closed, merged, target main, and belong to mnfst/modelparameters.dev.
  • Stores raw JSON for HMAC verification; fetch appends ?refresh=<ts> to bypass CDN; response includes model_count and last_fetched_at.
  • Docs updated and tests added.

• Migration

  • Set MODEL_PARAMETERS_WEBHOOK_SECRET in the deployment.
  • Add a GitHub webhook on mnfst/modelparameters.dev: URL https://<manifest-host>/api/v1/webhooks/model-parameters/github, content type application/json, secret = MODEL_PARAMETERS_WEBHOOK_SECRET, events = Pull requests.

^{Written for commit 7a2673c. Summary will update on new commits. Review in cubic}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.24%. Comparing base (dce3236) to head (7a2673c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1961   +/-   ##
=======================================
  Coverage   99.24%   99.24%           
=======================================
  Files         169      169           
  Lines       15333    15333           
  Branches     5991     5991           
=======================================
  Hits        15218    15218           
  Misses        113      113           
  Partials        2        2           

Flag	Coverage Δ
frontend	99.26% <ø> (ø)
shared	98.75% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cubic-dev-ai]

No issues found across 8 files

_{Re-trigger cubic}