Webhooks Reference

Webhooks Reference

GitHub → zyvor-qa serve event wiring.

Deep: GitHub Integration · Tutorial 04.

Setup

# .env
GITHUB_WEBHOOK_SECRET=<random-string>
zyvor-qa serve --port 8080

Product repo → Settings → Webhooks:

Field	Value
URL	https://<host>/webhook/github
Content type	application/json
Secret	same as GITHUB_WEBHOOK_SECRET
Events	push, pull_request, repository_dispatch

Events handled

Event	Behavior
pull_request	Full pipeline; comment on PR
push	Full pipeline; changed files scope coverage
repository_dispatch (staging-deployed)	Post-deploy pipeline
Other	{"status":"ignored"}

Security

• HMAC via X-Hub-Signature-256 — mismatch → 401
• Enterprise: signatures required; X-GitHub-Delivery required; replay IDs rejected — Enterprise
• Never leave secret empty in production

Local testing

curl -s http://localhost:8080/health
# Tunnel: cloudflared / ngrok / ssh -R for real GitHub delivery

Trigger post-deploy:

gh api repos/$ZYVOR_PRODUCT_REPO/dispatches \
  -f event_type=staging-deployed \
  -F 'client_payload[pr_number]=42'

Or dispatch into the agent repo’s Actions — Agent CI and Kubernetes.

Troubleshooting

Symptom	Fix
401 Invalid signature	Secret mismatch
Events ignored	Wrong event types selected
No PR comment	Need Pull requests: Write + PR number

Related: Troubleshooting · Admin Basics