A lightweight Express middleware for handling GitHub Webhooks, version 1.0.6. It validates webhook signatures using a secret, parses event payloads, and emits events for easy integration. Unlike alternatives like `github-webhook-handler`, this package is designed specifically for Express and requires body-parser. Release cadence is low; last update was years ago, but the package is stable for basic use cases.
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
This package is CJS-only; no ESM support.
const GithubWebHook = require('express-github-webhook');
GithubWebHook is a factory function, not a constructor. Do not use 'new'.
const webhookHandler = GithubWebHook({ secret: 'mysecret' });
For named events (not '*'), callback signature is (repo, data). The 'event' parameter is omitted.
webhookHandler.on('push', function(repo, data) { ... });
Sets up an Express server with body-parser and the GitHub webhook middleware, listens for push events and wildcard events.
const express = require('express');
const bodyParser = require('body-parser');
const GithubWebHook = require('express-github-webhook');
const app = express();
app.use(bodyParser.json());
const webhookHandler = GithubWebHook({ path: '/webhook', secret: process.env.GITHUB_SECRET ?? '' });
app.use(webhookHandler);
webhookHandler.on('push', function(repo, data) {
console.log('Push event on repo:', repo);
console.log('Payload:', data);
});
webhookHandler.on('*', function(event, repo, data) {
console.log(`Any event ${event} on repo ${repo}`);
});
app.listen(3000, () => console.log('Server listening on port 3000'));
Upgrade
Version history
Breaking-change detection hasn't run for this library yet.
Audit
Security & dependencies
CVE tracking and dependency tree are planned for a later release.