GitHub

Ricochet checks GitHub’s X-Hub-Signature-256 header and can drop redeliveries of a delivery it already stored.

Set up the source

1. In the dashboard, create a source and pick GitHub as the sender (verification method github). Copy its URL.
2. In GitHub, open the repository’s or organization’s Settings → Webhooks → Add webhook. Paste the URL as the payload URL and choose application/json as the content type.
3. Generate a secret (for example openssl rand -hex 32), set it as the webhook’s secret in GitHub and as the source’s secret in Ricochet.

GitHub sends a ping event when you save the webhook; it shows in the events list.

What Ricochet checks

X-Hub-Signature-256 must be sha256= followed by the hex HMAC-SHA256 of the body with the secret. GitHub’s signature has no timestamp, so there is no clock check. A request that fails is answered 401 and not stored, unless the source quarantines failures.

Deduplication

With the source’s deduplication set to GitHub, a request whose X-GitHub-Delivery was already stored in the last 3 days (configurable) is answered without storing it again. Redelivering from GitHub’s settings sends the same delivery ID, so it is dropped too; replay the event from Ricochet instead.

Event types

The event type is the X-GitHub-Event header, such as push or pull_request.

ricochet listen --forward localhost:3000/webhooks --event-type push

Sample events

ricochet trigger github push
ricochet trigger github push --set ref=refs/heads/main --edit

Samples: issues, ping, pull_request, push and release.