GitHub Webhook Delivery
Route GitHub push events, pull requests, issue updates, and CI workflow notifications to public HTTP targets with no customer-side runtime, or to services inside your private network — behind NAT, firewall, or VPN.
The Problem
GitHub sends webhooks to a public URL for push events, pull requests, issues, releases, and workflow runs. When your CI/CD pipeline, deployment automation, or code review tooling runs behind a corporate firewall, GitHub can't reach those services directly without opening inbound access.
Why This Is Hard
GitHub's webhook signature verification (HMAC-SHA256 with your secret) validates that the payload came from GitHub, but the receiving endpoint must still be publicly reachable. Exposing a CI trigger endpoint to the internet creates a potential vector. Self-hosted runners partially solve the build issue but don't address receiving webhook events into private services for automation, notification, or audit.
How Zen Mesh Helps
Zen Mesh provides a GitHub-ready webhook endpoint. You choose how events reach your service:
Option 1: Managed Public Delivery (no customer-side runtime)
For supported inbound webhook workflows, Zen Mesh provides a direct managed alternative: create a public webhook endpoint, validate and process events, and deliver to a public HTTPS destination without installing an agent, container, or Kubernetes component. The GitHub template validates HMAC-SHA256 signatures at the ingress plane. Point your GitHub webhook to Zen Mesh, and events are delivered to your public HTTPS target. No agent, no Docker, no Kubernetes.
Option 2: Private Edge Delivery (outbound-only)
When the same destination is private, Zen Mesh can extend the flow through Edge using outbound-only connectivity, without publishing the target or opening inbound firewall access. GitHub events arrive at the same Zen Mesh endpoint. If your target CI or deployment service is behind a firewall, Edge delivers through an outbound-only tunnel. No inbound ports, no public relay inside your perimeter.
Both options share the same GitHub template, signature verification, retry/DLQ policies, and operational visibility — only the delivery path differs.
GitHub Template Pack
The GitHub template includes pre-configured defaults for endpoint setup, HMAC verification parameters, event type mapping (push, pull_request, issues, workflow_run, etc.), and operational visibility.
Runtime Path
Select the GitHub template from the Zen Mesh Registry.
Apply GitHub defaults: endpoint URL, HMAC verification, event type mapping.
Define which GitHub events route to which internal service — pushes, PRs, releases, etc.
Bind the GitHub endpoint, blueprint, and private target into a delivery flow.
Point delivery at your internal CI trigger service or deployment automation.
Security & Evidence
GitHub HMAC-SHA256 signatures validated at ingress. Delivery uses mTLS + HMAC on the data plane. Delivery receipts and operational metadata. See Security for scope and maturity. Review per-capability status in claim-maturity and the non-claims registry.
Current Status
GitHub templates are available as part of the Provider Template Pack (V1). Signature verification for supported provider templates is validated in local/sandbox. Free Forever and Pro Early Bird tiers include GitHub support. Evidence system tracks per-capability status — local/sandbox validation, production-live validation, and planned capabilities are distinguished.
FAQ
Can I receive GitHub webhooks without installing any agent or runtime?
Yes. Managed Public Delivery delivers GitHub events to a public HTTPS target with no customer-side runtime. Point GitHub to your Zen Mesh endpoint and events are delivered directly — no agent, no Docker, no Kubernetes.
How do I receive GitHub webhooks behind a firewall?
Use Private Edge Delivery. Edge connects outbound to Zen Mesh from inside your network, so GitHub push, PR, and CI events reach your private infrastructure without opening inbound firewall ports.
Does Zen Mesh verify GitHub webhook signatures?
Yes. GitHub uses HMAC-SHA256 signatures. The GitHub template validates webhook signatures at the ingress plane before payloads reach your network.
Can I route different GitHub events to different services?
Yes. Define blueprints that map GitHub event types — push, pull request, issues, CI — to separate internal targets. Each event type follows its own delivery path.
Ready to try GitHub delivery?
Two delivery modes. One GitHub template. Free Forever tier available.