GitHub.Webhook reference

RepositoryEventSourceLive

Source: packages/github/src/RepositoryEventSourceLive.ts Kind: Layer · Provides: GitHub.RepositoryEventSource

GitHub event source on any WebhookHost.

Deploy-time: provisions a Webhook on the repository whose delivery URL points at the host (at a deterministic per-repo path). The webhook secret (the caller’s secret, or a generated random one when omitted) is bound onto the host via an Output accessor so the runtime can verify delivery signatures.

Runtime: claims requests on the repository’s delivery path, verifies the HMAC-SHA256 signature against the bound secret, and forwards each delivery to the subscriber. Requests on any other path fall through to the host’s own handler.

Every Cloudflare Worker is a WebhookHost, so this is the only layer to provide.

Webhook

Source: packages/github/src/Webhook.ts

A GitHub repository webhook.

Webhook manages the lifecycle of a repository webhook that POSTs events to a delivery URL. It is created on the first deploy and updated in place on subsequent deploys, and is deleted when the resource is destroyed.

Authentication is resolved via the GitHub Credentials service supplied by GitHub.providers() (env, stored PAT, or gh CLI). The token needs repo scope (admin access to the repository) to manage webhooks.

Most users don’t construct Webhook directly — prefer events(repository, handler) inside a Cloudflare Worker, which provisions the webhook, wires the delivery URL to the Worker, and forwards verified events to your handler.

Webhook: Creating a Webhook

Forward push events to a URL

yield* GitHub.Webhook("ci-webhook", {
  owner: "my-org",
  repository: "my-repo",
  url: "https://example.com/github",
  events: ["push", "pull_request"],
  secret: Redacted.make(process.env.WEBHOOK_SECRET!),
});

Point a webhook at a Worker

const worker = yield* Cloudflare.Worker("Api", { ... });

yield* GitHub.Webhook("repo-webhook", {
  owner: "my-org",
  repository: "my-repo",
  url: worker.url!,
  events: ["*"],
});