Task 2.6: Build GitHub App backend MVP in Rust (Axum)

[ajianaz]

Build a minimal Rust backend that receives GitHub webhooks and runs cora review.

Architecture

POST /webhook/github → verify HMAC → parse PR event → fetch diff → cora review → post PR comment + check run
GET /health → 200 OK

Checklist

• New Rust project (or workspace member): cora-app or similar
• Axum web server with webhook endpoint
• HMAC-SHA256 signature verification (X-Hub-Signature-256)
• GitHub API client: fetch PR diff via GET /repos/{owner}/{repo}/pulls/{number}/files
• Cora review integration: call cora-cli library (from Task 2.5)
• Config: read from .cora.yaml in repo (BYOK — user provides their API key)
• PR comment posting via GitHub API (octocrab or reqwest)
• Check run creation: POST repos/{owner}/{repo}/commits/{sha}/check-runs
• Error handling: timeout → fail check run with message; LLM error → helpful comment
• Env vars: GITHUB_APP_ID, GITHUB_PRIVATE_KEY, GITHUB_WEBHOOK_SECRET
• Deploy to Fly.io or Railway (free tier)
• Health check endpoint

Tech choices

• HTTP: Axum
• GitHub API: octocrab crate (or reqwest + manual)
• Config: env vars + .cora.yaml from repo
• Deploy: Fly.io (Rust native, free tier)

Part Of: #118, #120
Depends On: #131 (Task 2.5 — lib extraction)