Ruby

GitHub webhook with Ruby on Rails

Use request.raw_post and secure_compare before allowing the event to reach processing.

Code sample

Webhook endpoint

Code samples, header names, event names, and signatures remain verbatim across locales.

class GithubWebhooksController < ApplicationController
  skip_forgery_protection

  def create
    body = request.raw_post
    sent = request.headers['X-Hub-Signature-256'].to_s
    digest = OpenSSL::HMAC.hexdigest('SHA256', ENV.fetch('GITHUB_WEBHOOK_SECRET'), body)
    expected = "sha256=#{digest}"
    valid = sent.bytesize == expected.bytesize &&
      ActiveSupport::SecurityUtils.secure_compare(sent, expected)
    return head :unauthorized unless valid

    GithubWebhookJob.perform_later(request.headers['X-GitHub-Delivery'],
      request.headers['X-GitHub-Event'], JSON.parse(body))
    head :accepted
  end
end

Setup steps

Verify the first delivery

Setup steps 1

Create a workspace in DevLog and copy the endpoint and Secret.

Setup steps 2

Configure the same Secret in GitHub and in your application’s secure environment variable.

Setup steps 3

Send a ping and confirm the signature, Delivery ID, and payload in the inbox.

Start free User guide