perf: throttle ReplayStore.prune, deduplicate key normalization, hoist regex, simplify retry-delay narrowing

[Copilot]

Several small but compounding inefficiencies in hot paths — every webhook invocation triggered a full O(n) Map scan, normalized the same private key string twice, and recompiled a regex on each SHA check.

Changes

• ReplayStore.prune() throttled — full O(n) expired-entry sweep was called 2–3× per webhook; now gated behind a configurable interval (default 60 s). Individual TTL checks on begin/getStatus lookups are unaffected.

  // Before: O(n) scan on every begin(), complete(), getStatus()
  prune(now = Date.now()) {
    for (const [key, value] of this.values.entries()) { … }
  }
  
  // After: scan at most once per pruneIntervalMs
  prune(now = Date.now()) {
    if (now - this.lastPruneTime < this.pruneIntervalMs) return;
    this.lastPruneTime = now;
    for (const [key, value] of this.values.entries()) { … }
  }

• Private-key normalization deduped (config/env.ts) — normalizePrivateKey() (regex replace + trim on a 2–4 KB string) was called twice on the same value to populate both GITHUB_PRIVATE_KEY and GITHUB_PRIVATE_KEY_PEM; normalized once and shared.

• looksLikeCommitSha regex hoisted (webhooks/github.ts) — /^[a-f0-9]{7,64}$/i literal promoted to module-level const COMMIT_SHA_RE, compiled once at load rather than on every release-job evaluation.

• getRetryDelayMs narrowing extracted (github/client.ts) — 7-level nested typeof/in chain replaced with a focused getRetryAfterHeader(error) helper that traverses error → response → headers → "retry-after" explicitly.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[chrismaz11]

@copilot Trust Signal Verification Failed