GitHub Webhook-Testguides

Replay + Signatur-Helper (Dashboard)

Open /dashboard or /dashboard/tunnels and use Webhook Command Center for this provider. It gives one-click replay and signature verification helpers.

instatunnel webhook verify --provider github --secret-env GITHUB_WEBHOOK_SECRET

curl -i -X POST "https://YOUR-SUBDOMAIN.instatunnel.my/webhooks/github" -H "Content-Type: application/json" --data-binary @sample-github.json

Required signature header: x-hub-signature-256

1. Lokales App-Setup

Create a local webhook endpoint at: /webhooks/github

import express from 'express'
import crypto from 'crypto'

const app = express()
app.post('/webhooks/github', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.header('x-hub-signature-256') || ''
  const rawBody = req.body as Buffer
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET!)
    .update(rawBody)
    .digest('hex')

  const signatureBuf = Buffer.from(signature)
  const expectedBuf = Buffer.from(expected)
  const valid =
    signatureBuf.length === expectedBuf.length &&
    crypto.timingSafeEqual(signatureBuf, expectedBuf)

  if (!valid) {
    return res.status(401).send('invalid signature')
  }

  console.log('github event:', req.header('x-github-event'))
  res.status(200).send('ok')
})

app.listen(3000, () => console.log('listening on :3000'))

2. InstaTunnel-Befehl ausfuhren

instatunnel 3000 --subdomain github-hooks

Keep a fixed subdomain so your provider dashboard URL does not keep changing.

3. Provider-Felder zum Einfugen

Use the helper below to generate exact values with your chosen subdomain and path.

4. Testevent senden

1. In repository settings, open the webhook and click "Redeliver" on a recent delivery.
2. Or click "Test delivery" after saving webhook settings.
3. Check your app logs for event type and successful signature check.

5. Signatur prufen

Verify this header on every request: x-hub-signature-256

const expected = 'sha256=' + crypto
  .createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET!)
  .update(rawPayloadBuffer)
  .digest('hex')

const valid = Buffer.from(signature).length === Buffer.from(expected).length &&
  crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
if (!valid) return res.status(401).send('invalid signature')

6. Retries und Idempotenz

• Use GitHub delivery ID as your idempotency key.
• Persist processed delivery IDs for a safe replay window.
• Handle out-of-order events by reading current resource state before mutating.

7. Haufige Fehler und schnelle Fixes