YAML + Python

GitHub webhook with GitHub Actions

Send a signed synthetic event to validate the endpoint and secret without exposing credentials in logs.

Code sample

Webhook endpoint

Code samples, header names, event names, and signatures remain verbatim across locales.

name: Webhook smoke test
on: workflow_dispatch
jobs:
  send:
    runs-on: ubuntu-latest
    steps:
      - name: Send signed test delivery
        env:
          WEBHOOK_URL: ${{ secrets.DEVLOG_WEBHOOK_URL }}
          WEBHOOK_SECRET: ${{ secrets.DEVLOG_WEBHOOK_SECRET }}
        shell: python
        run: |
          import hashlib, hmac, json, os, urllib.request, uuid
          body = json.dumps({'zen': 'DevLog smoke test'}, separators=(',', ':')).encode()
          signature = 'sha256=' + hmac.new(os.environ['WEBHOOK_SECRET'].encode(), body, hashlib.sha256).hexdigest()
          request = urllib.request.Request(os.environ['WEBHOOK_URL'], data=body, method='POST', headers={
              'Content-Type': 'application/json', 'X-GitHub-Event': 'ping',
              'X-GitHub-Delivery': str(uuid.uuid4()), 'X-Hub-Signature-256': signature})
          with urllib.request.urlopen(request) as response:
              print('Webhook accepted:', response.status)

Setup steps

Verify the first delivery

Setup steps 1

Create a workspace in DevLog and copy the endpoint and Secret.

Setup steps 2

Configure the same Secret in GitHub and in your application’s secure environment variable.

Setup steps 3

Send a ping and confirm the signature, Delivery ID, and payload in the inbox.

Start free User guide