GitHub webhook signatures and redelivery

How do I verify X-Hub-Signature-256 in Node?

import { createHmac, timingSafeEqual } from 'node:crypto';

/** GitHub: "sha256=" + hex HMAC-SHA256 over the raw body, in X-Hub-Signature-256. */
export function verifyGitHub(secret, header, rawBody) {
  const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(String(header ?? ''), 'utf8');
  return a.length === b.length && timingSafeEqual(a, b); // never ==, never startsWith
}

Does GitHub retry a failed webhook delivery?

import express from 'express';
import { verifyGitHub } from './verify-github.mjs';

const app = express();

// Ten seconds to answer, and no second chance from GitHub's side.
app.post('/webhooks/github', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verifyGitHub(process.env.GITHUB_WEBHOOK_SECRET, req.get('x-hub-signature-256'), req.body)) {
    return res.status(401).send('signature mismatch');
  }

  // CREATE TABLE github_deliveries (
  //   guid text PRIMARY KEY, event text NOT NULL, hook_id text, payload jsonb NOT NULL,
  //   received_at timestamptz NOT NULL DEFAULT now(), processed_at timestamptz);
  const { rowCount } = await db.query(
    `INSERT INTO github_deliveries (guid, event, hook_id, payload)
     VALUES ($1, $2, $3, $4) ON CONFLICT (guid) DO NOTHING`,
    [req.get('x-github-delivery'), req.get('x-github-event'), req.get('x-github-hook-id'), JSON.parse(req.body)],
  );

  res.status(202).json({ stored: rowCount === 1 }); // a redelivery repeats the GUID: rowCount 0
});

How do I redeliver failed GitHub webhooks automatically?

// redeliver-failed.mjs: GitHub does not retry, so this does. Run it from cron.
// Token needs the repository webhooks permission (repo scope on a classic token).
const { GITHUB_TOKEN, OWNER, REPO, HOOK_ID } = process.env;
const api = `https://api.github.com/repos/${OWNER}/${REPO}/hooks/${HOOK_ID}/deliveries`;
const headers = {
  authorization: `Bearer ${GITHUB_TOKEN}`,
  accept: 'application/vnd.github+json',
  'x-github-api-version': '2022-11-28',
};

const res = await fetch(`${api}?per_page=100`, { headers });
if (!res.ok) throw new Error(`list deliveries: ${res.status}`);
const deliveries = await res.json();

// One event GUID may have several deliveries. If any of them succeeded, the
// event is done; redelivering it again would only exercise your idempotency.
const ok = (d) => d.status_code >= 200 && d.status_code < 300;
const done = new Set(deliveries.filter(ok).map((d) => d.guid));
const failed = deliveries.filter((d) => !ok(d) && !done.has(d.guid));

for (const d of failed) {
  const r = await fetch(`${api}/${d.id}/attempts`, { method: 'POST', headers });
  console.log(`${d.guid} ${d.event}${d.action ? '.' + d.action : ''}: was ${d.status_code}, redeliver -> ${r.status}`);
  done.add(d.guid);
}

Which headers does GitHub send with a webhook?

How do I deduplicate a GitHub redelivery?

Receive GitHub webhooks through a verified HookGet source

Receiving GitHub webhooks through HookGet

The contract

Setting it up

# 1. create a verified source; the secret is shown once
curl -X POST https://api.hookget.com/v1/sources \
  -H "authorization: Bearer $HOOKGET_KEY" \
  -H "content-type: application/json" \
  -d '{"provider":"github","name":"Production"}'

# {"id":"src_…","secret":"whsec_…","ingest_path":"/ingest/src_…"}

1. In the repository or organisation, open Settings → Webhooks → Add webhook.
2. Paste the ingest URL as the payload URL and the source secret as the secret.
3. Choose application/json as the content type.
4. Select the events you want. HookGet namespaces whatever arrives.

What you get after verification