From 4afa8d326d168f5ef81aed7da4d0798668bfa76b Mon Sep 17 00:00:00 2001
From: Vincent Duchauffour <vincent.duchauffour@proton.me>
Date: Thu, 13 Nov 2025 16:03:03 +0100
Subject: [PATCH 1/2] chore: add .env.example file

---
 .env.example | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 .env.example

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..e01be73
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,2 @@
+WEBHOOK_PROXY_URL=
+GITHUB_TOKEN=
\ No newline at end of file

From 34059d0dbf685055e66eb255080b98880122eb16 Mon Sep 17 00:00:00 2001
From: Vincent Duchauffour <vincent.duchauffour@proton.me>
Date: Thu, 13 Nov 2025 16:38:07 +0100
Subject: [PATCH 2/2] chore: update docs and models

---
 .env.example          |  3 ++-
 README.md             | 12 ++++++++++--
 compose.yaml          |  1 +
 scripts/github_app.py |  2 +-
 4 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.env.example b/.env.example
index e01be73..9394c1b 100644
--- a/.env.example
+++ b/.env.example
@@ -1,2 +1,3 @@
 WEBHOOK_PROXY_URL=
-GITHUB_TOKEN=
\ No newline at end of file
+GITHUB_TOKEN=
+GITHUB_WEBHOOK_SECRET=
\ No newline at end of file
diff --git a/README.md b/README.md
index edc2c4c..b41ba42 100644
--- a/README.md
+++ b/README.md
@@ -177,10 +177,18 @@ To ensure that you follow the development workflow, please setup the pre-commit
 uv run pre-commit install
 ```
 
-To test the webhook handler, use the `compose.yaml` file with the following command:
+### Run the application locally
+
+To test the webhook handler you need to fill an `.env` file, run:
+
+```shell
+cp .env.example .env
+```
+
+then run:
 
 ```shell
-WEBHOOK_PROXY_URL=https://smee.io/XXX docker compose up
+docker compose up
 ```
 
 ## Acknowledgements
diff --git a/compose.yaml b/compose.yaml
index f2ae5f9..aea7bb2 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -11,6 +11,7 @@ services:
       - ./tests:/opt/app/tests:z
     environment:
       - GITHUB_TOKEN=$GITHUB_TOKEN
+      - GITHUB_WEBHOOK_SECRET=$GITHUB_WEBHOOK_SECRET
     entrypoint:
       - uv
       - run
diff --git a/scripts/github_app.py b/scripts/github_app.py
index bb8edc4..f143a64 100644
--- a/scripts/github_app.py
+++ b/scripts/github_app.py
@@ -7,7 +7,7 @@
 from fastgithub import GithubWebhookHandler, SignatureVerificationSHA256, webhook_router
 from fastgithub.recipes.github import AutoCreatePullRequest, LabelsFromCommits
 
-signature_verification = SignatureVerificationSHA256(secret="mysecret")  # noqa: S106
+signature_verification = SignatureVerificationSHA256(secret=os.environ["GITHUB_WEBHOOK_SECRET"])  # noqa: S106
 webhook_handler = GithubWebhookHandler(signature_verification)
 
 github = Github(auth=Auth.Token(os.environ["GITHUB_TOKEN"]))