github-webhookslisted
Install: claude install-skill bertbertov/claude-stack
# GitHub Webhooks
## When to Use This Skill
- Setting up GitHub webhook handlers
- Debugging signature verification failures
- Understanding GitHub event types and payloads
- Handling push, pull request, or issue events
## Essential Code (USE THIS)
### GitHub Signature Verification (JavaScript)
```javascript
const crypto = require('crypto');
function verifyGitHubWebhook(rawBody, signatureHeader, secret) {
if (!signatureHeader || !secret) return false;
// GitHub sends: sha256=xxxx
const [algorithm, signature] = signatureHeader.split('=');
if (algorithm !== 'sha256') return false;
const expected = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
try {
return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
} catch {
return false;
}
}
```
### Express Webhook Handler
```javascript
const express = require('express');
const app = express();
// CRITICAL: Use express.raw() - GitHub requires raw body for signature verification
app.post('/webhooks/github',
express.raw({ type: 'application/json' }),
(req, res) => {
const signature = req.headers['x-hub-signature-256']; // Use sha256, not sha1
const event = req.headers['x-github-event'];
const delivery = req.headers['x-github-delivery'];
// Verify signature
if (!verifyGitHubWebhook(req.body, signature, process.env.GITHUB_WEBHOOK_SECRET)) {
console.error('GitHub signature verification failed');
return r