Promptwatch Logo

GitHub Hookshot

GitHub's webhooks for events like push, pull request, etc.
GitHub
Webhook

What is GitHub Hookshot?

GitHub Hookshot is the delivery client behind GitHub webhooks. When a webhook subscribes to an event such as push or pull_request, GitHub sends an HTTP POST to its configured payload URL. X-GitHub-Event names the event, while the GUID in X-GitHub-Delivery identifies that delivery. The user agent always starts with GitHub-Hookshot/.

A webhook configured with a secret receives an X-Hub-Signature-256 header. GitHub calculates this value as an HMAC-SHA256 digest of the request body and prefixes it with sha256=. The receiver should calculate the digest from the unchanged body and compare the two values with a constant-time function. A matching user agent by itself does not authenticate the sender.

GitHub expects a 2xx response within 10 seconds. It closes a slower connection and marks that delivery as failed. Failed deliveries are not retried automatically, though an administrator or integration can request a redelivery through GitHub's interface or REST API. A requested redelivery keeps the original X-GitHub-Delivery value, so the receiver can avoid repeating work.

Hookshot does not browse public pages, build a search index, or collect a training corpus. It calls the one payload URL saved in a webhook configuration after a subscribed GitHub event occurs. A robots.txt file has no part in that exchange and cannot permit or stop delivery.

Not relevant for AI search

Is GitHub Hookshot relevant for AI search?

No. GitHub Hookshot is not part of AI search or training, so allowing or blocking it does not change your AI visibility.

GitHub Hookshot is not a crawler. It delivers webhook notifications to endpoints you registered, so it never fetches public content for an AI product. Robots.txt does not apply, and allowing or blocking it has no effect on AI search or training.

How to handle GitHub Hookshot

Give each GitHub webhook a strong secret and keep that value outside the repository. Read the request body without changing it, verify X-Hub-Signature-256, and reject a missing or invalid signature before acting on the payload. Use X-GitHub-Event to select the handler rather than trusting fields that happen to be present in the JSON.

Record X-GitHub-Delivery, enqueue any longer work, and return a 2xx response within 10 seconds. If the same delivery ID arrives again, acknowledge it without repeating the side effect. Review failed deliveries in GitHub and request redelivery after the endpoint is healthy, since GitHub does not do that automatically.

Do not add a robots.txt rule for Hookshot. To stop expected traffic, deactivate or delete the webhook, remove its event subscriptions, or change the payload URL. For an endpoint that should remain active, signature validation is the relevant access check.

Examples

  • A repository push causes GitHub Hookshot to POST a `push` payload. The receiver verifies `X-Hub-Signature-256`, stores the delivery GUID, returns 202, and queues its deployment work.
  • An operator redelivers a failed pull request event after an outage. The endpoint sees the original `X-GitHub-Delivery` value and does not create a second review task.
  • A request copies the `GitHub-Hookshot/` user agent but has no valid signature. The endpoint rejects it without parsing the claimed event.

Frequently asked questions about GitHub Hookshot

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

An event selected in an active GitHub webhook occurs. GitHub then sends that event's payload to the URL stored in the webhook configuration.

Related bots

GitHub Camo

GitHub Camo sits between a GitHub reader and an externally hosted image.

Preview

Adyen Webhook

Adyen sends HTTP POST webhooks for events that a payment integration cannot safely infer from a browser return or an immediate API response.

Webhook

Atlassian Jira Webhooks

Delivers webhook notifications from Jira Cloud when issues, projects, or other resources change.

Webhook

Customer.io webhooks

Customer.io's webhook service for event-driven marketing automation and customer data platform.

Webhook

Facebook Webhooks

Facebook's webhook service that delivers real-time event notifications for Meta platform events and changes.

Webhook

Be the brand AI recommends

Monitor your brand's visibility across ChatGPT, Claude, Perplexity, and Gemini. Get actionable insights and create content that gets cited by AI search engines.

Promptwatch Dashboard