---
title: "Github Webhook"
method: POST
path: "/webhooks/github"
---

# Github Webhook

`POST /webhooks/github`

Receive a GitHub App webhook, verify signature, and create tasks.

Handles the following event types:
- ``issues`` (opened / labeled)
- ``pull_request_review_comment`` / ``issue_comment``
- ``push``
- ``workflow_run`` (completed + failure) - creates a ci-fix task, capped at
  ``MAX_CI_RETRIES`` active attempts per branch.

Reads ``GITHUB_WEBHOOK_SECRET`` from environment for HMAC verification.
Fail-closed: when the secret is not configured the
endpoint is disabled and returns 503; unsigned GitHub webhooks are
never accepted.
Replay protection: if the caller includes an
``X-Bernstein-Timestamp`` header the request is additionally
checked for freshness - drift greater than five minutes returns
401.  Real GitHub deliveries omit this header and continue to
work; the check is there so bernstein-internal relays cannot be
replayed after capture.
Returns 200 on success, 401 on bad/missing signature or stale
timestamp, 400 on parse error, 503 when the endpoint is not
configured.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.net/sipyourdrink-ltd/apis/bernstein-task-server.md) · [All operations](https://skmtc.net/sipyourdrink-ltd/apis/bernstein-task-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sipyourdrink-ltd/bernstein-task-server/versions/86f514b4e920/schema)