GitHub webhooks
Push + PR triggers, signature verification, what happens on every commit.
4 min read3 sections
When you install the EDITH GitHub App, a webhook fires on every push and pull_request event. The flow:
- GitHub sends the event to
/api/github/webhook - EDITH verifies the signature (
x-hub-signature-256) - We enqueue an Inngest scan event
- A worker picks it up, runs the scan, posts a PR comment with findings + score
Every webhook is signed with HMAC-SHA256 using your installation's secret. EDITH rejects any request that fails verification with HTTP 401 and logs the attempt to the audit log.
On every PR, EDITH posts (or updates) a single comment with:
- Headline score
- Findings grouped by severity
- Drift vs the base branch (newly introduced issues)
- One Copy fix prompt button per finding
The comment updates in-place on every new commit to the PR.