- How do I install swop/github-webhook in Laravel?
- Install it with Composer using composer require swop/github-webhook. Because the last release was in 2020 and the repository is unknown, first confirm the package identity, license, and source on Packagist before adding it to a Laravel app. Test the installation on a branch against your current PHP and Laravel baseline.
- Does swop/github-webhook validate X-Hub-Signature-256?
- The package is described as validating GitHub webhook signatures, including X-Hub-Signature-256 and legacy signatures. Verify this against GitHub test deliveries before trusting it, since signature validation is security-sensitive. If validation is incomplete or stale, wrap or replace it with hash_hmac('sha256', $rawBody, $secret) using the raw request body.
- What Laravel and PHP versions does swop/github-webhook support?
- The available context does not confirm supported Laravel or PHP versions, and the last release was 2020-11-14. Check the Composer constraints and test on PHP 8.1, 8.2, and 8.3 before using it. Do not let it force a framework downgrade.
- How do I route GitHub webhook events to handlers with this package?
- The intended API is event-driven: route the webhook request to a thin Laravel controller or middleware, then let the package parse the payload and dispatch typed events to dedicated handler classes. Keep secret storage, routing, idempotency, logging, and queue dispatch in your application. Confirm the exact event names and handler registration from the package source.
- Does it support push, pull_request, issues, and ping events?
- The blurb mentions pushes, pull requests, issues, and more, so common GitHub events are likely covered. Ping events, content types, and unsupported event handling are not confirmed by the provided context. Test ping, push, pull_request, issues, and an unknown event type with real deliveries.
- Is swop/github-webhook safe for production use?
- Treat it as high risk for direct production use: the repository is unknown, stars are low, and the last release was in 2020. It may lack PHP 8.x compatibility, dependency updates, or security patches. Use it only behind an internal interface, with monitoring and a tested fallback, or vendor the minimal validation logic.
- How do I test GitHub webhooks with this package?
- Test it with GitHub's webhook redelivery feature or a local tunnel, sending ping, push, pull_request, and malformed requests. Compare parsed payloads to the raw request body and assert that invalid or missing signatures are rejected. Add contract tests around signature validation so you can swap the package later.
- Is swop/github-webhook framework-agnostic or Laravel-specific?
- It is described as a library for incoming GitHub webhook requests, but the context does not confirm whether it is framework-agnostic or Laravel-specific. The integration guidance recommends using it behind a thin Laravel adapter rather than scattering it through domain code. Check the source before assuming it works outside Laravel.
- How does it handle malformed JSON, missing signatures, and payload limits?
- The package parses JSON payloads, but the provided context does not confirm payload size limits, content-type handling, or exact behavior for malformed JSON and missing signatures. Your endpoint should still reject missing or malformed signatures, limit request size at the web layer, and log failures without exposing secrets. Verify these cases with test deliveries.
- What are alternatives to swop/github-webhook?
- For a small, security-sensitive concern like this, a short internal verifier using hash_hmac('sha256', $rawBody, $secret) and json_decode is a viable alternative with no long-term lock-in. If you keep the package, isolate it behind an internal interface and contract tests. Review Composer metadata and known CVEs before choosing either path.