---
title: "Github Webhook"
method: POST
path: "/api/v1/webhooks/github"
---

# Github Webhook

`POST /api/v1/webhooks/github`

Receive a GitHub App webhook, verify signature, and create tasks.

Handles the following event types:
- ``issues`` (opened / labeled)
- ``pull_request_review_comment`` / ``issue_comment``
- ``push``
- ``workflow_run`` (completed + failure) - creates a ci-fix task, capped at
  ``MAX_CI_RETRIES`` active attempts per branch.

Reads ``GITHUB_WEBHOOK_SECRET`` from environment for HMAC verification.
Fail-closed: when the secret is not configured the
endpoint is disabled and returns 503; unsigned GitHub webhooks are
never accepted.
Replay protection: if the caller includes an
``X-Bernstein-Timestamp`` header the request is additionally
checked for freshness - drift greater than five minutes returns
401.  Real GitHub deliveries omit this header and continue to
work; the check is there so bernstein-internal relays cannot be
replayed after capture.
Returns 200 on success, 401 on bad/missing signature or stale
timestamp, 400 on parse error, 503 when the endpoint is not
configured.

## Response `200`

Successful Response

- unknown

## Changes

> 15 revisions in range; 7 could not be searched.

- **2026-07-26** `2a1299ef19fa` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/sipyourdrink-ltd/apis/bernstein-task-server/changes/api/v1/webhooks/github/post.md)

---

[API](https://skmtc.dev/sipyourdrink-ltd/apis/bernstein-task-server.md) · [All operations](https://skmtc.dev/sipyourdrink-ltd/apis/bernstein-task-server/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/sipyourdrink-ltd/bernstein-task-server/revisions/7f4871ff054a/schema)