Guide · GitHub → Grok Bot · Verified November 1, 2026
GitHub to Grok Bot webhook guide
Short answer: One GitHub endpoint verifies each delivery, a destination filter keeps the events in this guide, and every match is delivered to Grok Bot with its own retry schedule and delivery log.
The commonest agent workflow on GitHub is triage: a person labels an issue agent, and a Grok Bot routine picks it up with the title, body, and link. The label is the approval gate — an unlabeled issue never becomes a task, even if it is opened by a maintainer.
At a glance
1. Configure the GitHub webhook
- In the repository, open Settings → Webhooks → Add webhook and paste the endpoint's ingestion URL.
- Set Content type to application/json and paste the same signing secret the endpoint uses.
- Choose “Let me select individual events” and enable Issues, Issue comments, Pull requests, Pushes, Releases, and Workflow runs as needed.
- Open or label an issue to send the first delivery, then check the delivery log.
HMAC-SHA256 over the raw request body, compared in constant time. No timestamp header, so there is no clock-window check.
2. Filter to the events that matter
Filters run per destination before rendering, so a non-matching event is stored with no delivery and no agent call. The rules below are the difference between a useful pairing and a noisy one.
Filter: issues opened or labeled `agent`
{
"allow": [
{
"field": "event.type",
"op": "in",
"value": ["issues.opened", "issues.labeled"]
},
{ "field": "event.subject.labels", "op": "contains", "value": "agent" }
],
"senders": {
"allow": { "associations": ["OWNER", "MEMBER", "COLLABORATOR"] }
},
"ignoreBots": true
}3. Configure the Grok Bot destination
A Hooks destination POSTs one JSON task to your Grok Bot routine URL with a Bearer key; a 2xx means the task was queued. Configure the routine URL and key once, then map event fields into the task template.
Destination: Grok Bot routine
{
"routineUrl": "https://grok.example.com/routines/abc123",
"key": "{{secret.GROKBOT_KEY}}",
"task": "{{event.subject.title}}\n\n{{event.subject.body | truncate:2000}}\n{{event.subject.url}}",
"repo": "{{event.repo}}"
}Secrets enter configs only as {{secret.NAME}} references; literal credentials are rejected. Full Grok Bot target guide
4. Verify the delivery and its retries
Send one real event from the source, then open Deliveries. A 2xx from the target means accepted, not finished. 408, 425, 429 and 5xx retry with backoff honoring Retry-After; other 4xx fail permanently with a named code. The rendered request is stored per attempt, so a bad field path is visible without re-sending.
The pitfall this pairing hits
A labeled event fires on every label, not just agent. The filter checks the current label list, so issues.labeled for docs also runs the filter and correctly fails. If an issue is labeled agent twice the delivery is deduplicated by X-GitHub-Delivery only when GitHub retries; two distinct deliveries create two tasks.
Frequently asked questions
Do I need one endpoint per source or one per destination?
One endpoint per source. Each destination under that endpoint carries its own filter, template, retry schedule, and delivery log, so the same event can feed several targets without duplicate ingress URLs.
What happens while the target is down?
Retryable failures back off and retry within the destination's window; permanent 4xx failures stop immediately. Either way, the original event stays stored, so after fixing the target you replay the event instead of asking the source to send it again.
A labeled event fires on every label, not just agent
The filter checks the current label list, so issues.labeled for docs also runs the filter and correctly fails. If an issue is labeled agent twice the delivery is deduplicated by X-GitHub-Delivery only when GitHub retries; two distinct deliveries create two tasks.