github-webhooks

name	github-webhooks
description	Receive and verify GitHub webhooks. Use when setting up GitHub webhook handlers, debugging signature verification, or handling repository events like push, pull_request, issues, or release.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

GitHub Webhooks

When to Use This Skill

• Setting up GitHub webhook handlers
• Debugging signature verification failures
• Understanding GitHub event types and payloads
• Handling push, pull request, or issue events

Verification (core)

GitHub signs the raw body with HMAC-SHA256 keyed on your webhook secret and sends the digest in X-Hub-Signature-256 formatted as sha256=<hex>. Use X-Hub-Signature-256 (not the legacy SHA-1 X-Hub-Signature), pass the raw body, and compare timing-safe.

Node:

const crypto = require('crypto');

function verify(rawBody, signatureHeader, secret) {
  const [algo, sig] = (signatureHeader || '').();
   (algo !==  || !sig)  ;
   expected = crypto.(, secret).(rawBody).();
   {
     crypto.(.(sig), .(expected));
  }  {
     ;
  }
}