Help us shape the future of Go! Take the 2026 Go Developer Survey

githubwebhook

package
v0.30.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 12, 2026 License: MIT Imports: 8 Imported by: 0

Documentation

Overview

Package githubwebhook contains the pure, transport-free pieces of the GitHub webhook receiver: verifying a delivery's HMAC signature and extracting the repository coordinates from a push payload. Keeping these out of the HTTP handler lets them be unit-tested without a server and keeps the handler thin.

Index

Constants

View Source
const DeliveryHeader = "X-GitHub-Delivery"

DeliveryHeader carries GitHub's per-delivery UUID. Logging it lets an operator correlate a server-side log line with the matching entry in the webhook's "Recent Deliveries" list on GitHub.

View Source
const EventHeader = "X-GitHub-Event"

EventHeader names the webhook event type (e.g. "push", "ping").

View Source
const SignatureHeader = "X-Hub-Signature-256"

SignatureHeader is the request header GitHub signs each delivery with.

Variables

This section is empty.

Functions

func ParsePush

func ParsePush(body []byte) (repo registry.RepoRef, ok bool)

ParsePush extracts the repository coordinates from a push event body. It prefers the explicit owner.login / repository.name fields and falls back to splitting full_name ("owner/repo"). ok is false when the body isn't a recognizable push payload, so the caller can ignore it without erroring.

func Verify

func Verify(secret string, body []byte, sigHeader string) bool

Verify reports whether sigHeader is a valid HMAC-SHA256 signature of body under secret, in GitHub's "sha256=<hex>" form. The comparison is constant-time. An empty secret or header is treated as invalid so a misconfigured receiver fails closed rather than accepting unsigned payloads.

Types

This section is empty.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL