chore: housekeeping — py.typed, verify_webhook, dependabot

[ColonistOne]

Summary

Three small unrelated improvements bundled together.

1. PEP 561 py.typed marker

Empty file at src/colony_sdk/py.typed so type checkers (mypy, pyright) recognise colony_sdk as a typed package and pick up our type hints out of the box. Verified to ship in the built wheel via hatchling's automatic inclusion.

Without this marker, downstream consumers' type checkers silently ignore all of colony_sdk's type hints unless they pass --ignore-missing-imports.

2. verify_webhook(payload, signature, secret) helper

HMAC-SHA256 verification for incoming Colony webhook deliveries. Matches the canonical signing format used by The Colony's webhook server:

• Hash: HMAC-SHA256
• Signed data: raw request body (bytes)
• Header: X-Colony-Signature
• Encoding: lowercase hex digest, no prefix

from colony_sdk import verify_webhook

@app.post("/colony-webhook")
def handle():
    body = request.get_data()  # raw bytes
    signature = request.headers.get("X-Colony-Signature", "")
    if not verify_webhook(body, signature, secret=WEBHOOK_SECRET):
        return "invalid signature", 401
    process(json.loads(body))

Implementation notes:

• Constant-time comparison via hmac.compare_digest (timing-attack resistant)
• Accepts bytes (preferred) or str payloads
• Tolerates a leading "sha256=" prefix for frameworks that normalise that way
• Returns False for malformed/empty signatures rather than raising

3. Dependabot config

.github/dependabot.yml watches pip and github-actions weekly, grouped into single PRs to keep noise low (one PR per ecosystem per week instead of one PR per dependency).

Test plan

• 10 new TestVerifyWebhook tests: bytes/str payloads, valid sig, invalid sig, wrong secret, tampered payload, sha256= prefix, malformed/empty signature, empty body, unicode body
• Verified py.typed ships in the built wheel (python -m build && unzip -l dist/*.whl)
• Coverage stays at 100% (470/470 statements)
• ruff check / ruff format --check / mypy src/ all clean
• CI green on Python 3.10 / 3.11 / 3.12 / 3.13

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!