Secure GitHub Webhooks with HMAC256 Signature Validation

About

Use cases Ensure that the calls to the workflow's webhook are (a) originating from the correct GitHub repository and (b) haven't been tampered with. How it works When a secret is provided in a GitHub webhook configuration, a x-hub-signature-256 header is added to the webhook. Compute HMAC256 computes the HMAC256 signature similarly to how it was computed by GitHub. Validate HMAC256 tests for the equality of the computed value and the value provided by the header. If the values are equal then