> ## Documentation Index
> Fetch the complete documentation index at: https://supahooks.ar27111994.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Test GitHub webhook events and CI callbacks

> Capture GitHub App and repository webhook deliveries, verify X-Hub-Signature-256 signatures, inspect push and PR events, and replay CI callbacks.

GitHub signs every webhook delivery with an HMAC-SHA256 signature in the `X-Hub-Signature-256` header. Use the Webhook Debugger to confirm your webhook secret is correct, inspect individual push, pull request, and deployment events, and replay a specific delivery to staging without waiting for the next real trigger.

## Configure the actor for GitHub

Start the actor with the following input. Replace `replace_with_github_webhook_secret` with the secret you set in GitHub's webhook settings.

```json theme={null}
{
  "urlCount": 1,
  "retentionHours": 48,
  "authKey": "github-debug-key",
  "enableJSONParsing": true,
  "maskSensitiveData": true,
  "signatureVerificationSecret": "replace_with_github_webhook_secret",
  "signatureVerification": {
    "provider": "github"
  },
  "defaultResponseCode": 200,
  "defaultResponseBody": "{\"received\":true}",
  "forwardUrl": "https://staging.example.com/github/webhooks",
  "forwardHeaders": true,
  "replayMaxRetries": 3,
  "replayTimeoutMs": 10000,
  "alerts": {
    "slack": {
      "webhookUrl": "https://hooks.slack.com/services/AAA/BBB/CCC"
    }
  },
  "alertOn": ["signature_invalid", "5xx"]
}
```

GitHub verification uses the `X-Hub-Signature-256` header with a required `sha256=` prefix. The actor verifies the signature against the preserved raw request body, so the result stays valid even when `enableJSONParsing` is enabled.

After the actor starts, call `/info` to retrieve the generated webhook URL.

## Point your GitHub webhook at the generated URL

<Steps>
  <Step title="Open webhook settings">
    For a repository webhook, go to **Settings → Webhooks → Add webhook**. For a GitHub App, go to **Developer settings → GitHub Apps → your app → Edit → Webhook**.
  </Step>

  <Step title="Paste the endpoint URL">
    Copy the `/webhook/:id` URL from `/info` and paste it into the **Payload URL** field.
  </Step>

  <Step title="Set the content type">
    Set **Content type** to `application/json`.
  </Step>

  <Step title="Add the secret">
    Paste your webhook secret into the **Secret** field and copy the same value into `signatureVerification.secret` in the actor input.
  </Step>

  <Step title="Select events">
    Choose which events to send — **Just the push event**, **Send me everything**, or a custom selection that matches your CI workflow.
  </Step>
</Steps>

## Inspect push, PR, and deployment events

After GitHub delivers a webhook, query `/logs` to see what was captured. Filter by the `X-GitHub-Event` header to isolate a specific event type:

```bash theme={null}
GET /logs?webhookId=wh_abc123&headers.x-github-event=push
```

Look up a specific delivery by the ID GitHub shows in the webhook delivery history:

```bash theme={null}
GET /logs?webhookId=wh_abc123&headers.x-github-delivery=<delivery-id>
```

A captured push event looks like this:

```json theme={null}
{
  "id": "evt_8m2L5p9xR",
  "webhookId": "wh_abc123",
  "timestamp": "2026-01-30T12:00:00.000Z",
  "method": "POST",
  "statusCode": 200,
  "signatureValid": true,
  "signatureProvider": "github",
  "headers": {
    "x-github-event": "push",
    "x-github-delivery": "abc-123-def-456"
  },
  "body": {
    "ref": "refs/heads/main",
    "repository": {
      "full_name": "org/repo"
    }
  }
}
```

`signatureValid: true` confirms the actor verified `X-Hub-Signature-256` against your secret.

To check for signature failures:

```bash theme={null}
GET /logs?webhookId=wh_abc123&signatureValid=false
```

## Debug CI callback failures with replay

If a CI or deployment callback reached the actor but failed downstream, check `/system/metrics` for forwarding error details. Once you fix the downstream target, replay the original captured delivery to staging:

```bash theme={null}
curl -X POST \
  "https://<run-id>.runs.apify.net/replay/wh_abc123/evt_8m2L5p9xR?url=https%3A%2F%2Fstaging.example.com%2Fgithub%2Fwebhooks"
```

The replay uses the original captured method and payload, so your staging handler receives the same delivery GitHub originally sent.

<Tip>
  Use `responseDelayMs` in the actor input or append `?__status=500` to the webhook URL to simulate failure responses and test your CI error-handling paths before production changes.
</Tip>

## Common failure patterns

| Signal                          | What it usually means                                                       | What to do                                                                                   |
| :------------------------------ | :-------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------- |
| `signatureValid=false`          | Wrong webhook secret or missing `sha256=` prefix in the incoming header     | Re-check the GitHub webhook secret and inspect the captured raw request                      |
| Missing expected `action` field | The event type doesn't include the payload shape your workflow assumed      | Filter by `headers.x-github-event` first, then inspect the parsed body for that event family |
| Forwarding failures             | GitHub reached the actor but forwarding to your staging bridge failed later | Fix the downstream target, then replay the original delivery by log ID                       |