Guide · GitHub → T3 Code · Verified November 1, 2026
GitHub to T3 Code webhook guide
Short answer: One GitHub endpoint verifies each delivery, a destination filter keeps the events in this guide, and every match is delivered to T3 Code with its own retry schedule and delivery log.
T3 Code scheduled tasks with the On a webhook trigger accept one POST per run. Wired to GitHub, every new pull request can start a review run with the PR URL and repository; T3 Code answers 202 and the agent finishes asynchronously.
At a glance
1. Configure the GitHub webhook
- In the repository, open Settings → Webhooks → Add webhook and paste the endpoint's ingestion URL.
- Set Content type to application/json and paste the same signing secret the endpoint uses.
- Choose “Let me select individual events” and enable Issues, Issue comments, Pull requests, Pushes, Releases, and Workflow runs as needed.
- Open or label an issue to send the first delivery, then check the delivery log.
HMAC-SHA256 over the raw request body, compared in constant time. No timestamp header, so there is no clock-window check.
2. Filter to the events that matter
Filters run per destination before rendering, so a non-matching event is stored with no delivery and no agent call. The rules below are the difference between a useful pairing and a noisy one.
Filter: pull requests opened by maintainers
{
"allow": [
{ "field": "event.type", "op": "equals", "value": "pull_request.opened" }
],
"senders": {
"allow": { "associations": ["OWNER", "MEMBER", "COLLABORATOR"] },
"allowForkPrs": false
}
}3. Configure the T3 Code destination
A Hooks destination POSTs JSON to your T3 Code task's On a webhook URL; T3 Code answers 202 when the agent run is accepted. Keep the URL (it carries a token) in a project secret and sign the body when the task requires it.
Destination: T3 Code task
{
"url": "{{secret.T3CODE_WEBHOOK_URL}}",
"signature": {
"secret": "{{secret.T3CODE_SIGNING_SECRET}}",
"header": "x-hub-signature-256",
"encoding": "hex",
"prefix": "sha256="
},
"body": {
"title": "Review: {{event.subject.title}}",
"url": "{{event.subject.url}}",
"repo": "{{event.repo}}"
}
}Secrets enter configs only as {{secret.NAME}} references; literal credentials are rejected. Full T3 Code target guide
4. Verify the delivery and its retries
Send one real event from the source, then open Deliveries. A 2xx from the target means accepted, not finished. 408, 425, 429 and 5xx retry with backoff honoring Retry-After; other 4xx fail permanently with a named code. The rendered request is stored per attempt, so a bad field path is visible without re-sending.
The pitfall this pairing hits
Fork pull requests never arrive. Agent targets deny fork PRs unless senders.allowForkPrs is true, because the PR body is attacker-controlled. Keep it false for review agents, or accept the risk explicitly and template from trusted fields only.
Frequently asked questions
Do I need one endpoint per source or one per destination?
One endpoint per source. Each destination under that endpoint carries its own filter, template, retry schedule, and delivery log, so the same event can feed several targets without duplicate ingress URLs.
What happens while the target is down?
Retryable failures back off and retry within the destination's window; permanent 4xx failures stop immediately. Either way, the original event stays stored, so after fixing the target you replay the event instead of asking the source to send it again.
Fork pull requests never arrive
Agent targets deny fork PRs unless senders.allowForkPrs is true, because the PR body is attacker-controlled. Keep it false for review agents, or accept the risk explicitly and template from trusted fields only.