huggingface-webhooks

Name: huggingface-webhooks
Author: hookdeck

80stars10forks

How to install huggingface-webhooks?

hookdeck/webhook-skills/huggingface-webhooks

$npx -y skills add hookdeck/webhook-skills --skill huggingface-webhooks

Installs into the current project.

Summary

Receive and verify Hugging Face webhooks. Use when setting up Hugging Face webhook handlers, debugging X-Webhook-Secret verification, or handling events on models, datasets, and Spaces — repo updates, new commits and tags (repo.content), config changes (repo.config), discussions,

Files · 1

View on GitHub

SKILL.md

1	# Hugging Face Webhooks
2
3	## When to Use This Skill
4
5	- Setting up Hugging Face webhook handlers
6	- Debugging `X-Webhook-Secret` verification failures
7	- Handling repo events on models, datasets, and Spaces
8	- Reacting to new commits, tags, or branches via `updatedRefs`
9	- Building discussion or Pull Request bots on the Hub
10	- Listening for comments on discussions
11	- Auto-retraining models when a dataset is updated
12
13	## Essential Code (USE THIS)
14
15	Hugging Face does not use HMAC signatures. Instead, the secret you configure in the webhook settings is sent verbatim in the `X-Webhook-Secret` header (or as a `?secret=` query parameter). Verify with a timing-safe string comparison.
16
17	### Hugging Face Secret Verification (JavaScript)
18
19	```javascript
20	const crypto = require('crypto');
21
22	function verifyHuggingFaceWebhook(secretHeader, secret) {
23	if (!secretHeader \|\| !secret) return false;
24
25	// Hugging Face sends the secret verbatim — compare directly,
26	// but use timing-safe comparison to prevent timing attacks.
27	try {
28	return crypto.timingSafeEqual(
29	Buffer.from(secretHeader),
30	Buffer.from(secret)
31	);
32	} catch {
33	// Buffers must be same length for timingSafeEqual
34	return false;
35	}
36	}
37	```
38
39	### Express Webhook Handler
40
41	```javascript
42	const express = require('express');
43	const crypto = require('crypto');
44	const app = express();
45
46	// CRITICAL: Use express.json() — Hugging Face sends JSON payloads
47	app.post('/webhooks/huggingface',
48	express.json(),
49	(req, res) => {
50	// Header takes precedence; fall back to ?secret= query parameter
51	const secretHeader = req.headers['x-webhook-secret'] \|\| req.query.secret;
52
53	if (!verifyHuggingFaceWebhook(secretHeader, process.env.HUGGINGFACE_WEBHOOK_SECRET)) {
54	console.error('Hugging Face webhook verification failed');
55	return res.status(401).send('Unauthorized');
56	}
57
58	const { event, repo, discussion, comment, updatedRefs, updatedConfig, webhook } = req.body;
59
60	// event.scope + event.action identifies the event type
61	const key = `${event.scope}.${event.action}`;
62	console.log(`Received ${key} on ${repo.type} ${repo.name}`);
63
64	switch (event.scope) {
65	case 'repo':
66	// create \| update \| delete \| move
67	console.log(`Repo ${event.action}: ${repo.name}`);
68	break;
69	case 'repo.content':
70	// action is always "update"
71	console.log(`Repo content updated on ${repo.name}, refs:`, updatedRefs);
72	break;
73	case 'repo.config':
74	// action is always "update"
75	console.log(`Repo config updated:`, updatedConfig);
76	break;
77	case 'discussion':
78	// create \| update \| delete
79	console.log(`Discussion ${event.action} #${discussion?.num}: ${discussion?.title}`);
80	break;
81	case 'discussion.comment':
82	// create \| update
83	console.log(`Comment ${event.action} by ${comment?.author?.id}`);
84	break;
85	default:
86	// Forward-compatibility: treat narrowed scopes (e.g. repo.config.dois)
87	// as an "update" on the broader scope.
88	console.log(`Unknown scope: ${event.scope} (${event.action})`);
89	}
90
91	res.json({ received: true });
92	}
93	);
94	```
95
96	### Python Secret Verification (FastAPI)
97
98	```python
99	import secrets
100
101	def verify_huggingface_webhook(secret_header: str \| None, secret: str \| None) -> bool:
102	if not secret_header or not secret:
103	return False
104
105	# Hugging Face sends the secret verbatim — timing-safe string comparison.
106	return secrets.compare_digest(secret_header, secret)
107	```
108
109	> For complete working examples with tests, see:
110	> - [examples/express/](examples/express/) - Full Express implementation
111	> - [examples/nextjs/](examples/nextjs/) - Next.js App Router implementation
112	> - [examples/fastapi/](examples/fastapi/) - Python FastAPI implementation
113
114	## Common Event Types
115
116	Hugging Face webhook events are identified by `event.scope` + `event.action`.
117
118	\| `event.scope` \| `event.action` values \| Description \|
119	\|---------------\|----------------------\|-------------\|
120	\| `repo` \| `create`, `update`, `delete`, `move` \| Global events on a repo (model, dataset, Space) \|
121	\| `repo.content` \| `update` \| New commits, branches, or tags. `updatedRefs` is included \|
122	\| `repo.config` \| `update` \| Settings, secrets, DOI, privacy changes. `updatedConfig` is included \|
123	\| `discussion` \| `create`, `update`, `delete` \| Discussion or Pull Request opened, retitled, merged, or closed \|
124	\| `discussion.comment` \| `create`, `update` \| Comment created or

People who liked this also viewed

6 picks

Type

huggingface-webhooks

80stars10forks

View on GitHub

How to install huggingface-webhooks?

hookdeck/webhook-skills/huggingface-webhooks

$npx -y skills add hookdeck/webhook-skills --skill huggingface-webhooks

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Hugging Face Webhooks
2
3	## When to Use This Skill
4
5	- Setting up Hugging Face webhook handlers
6	- Debugging `X-Webhook-Secret` verification failures
7	- Handling repo events on models, datasets, and Spaces
8	- Reacting to new commits, tags, or branches via `updatedRefs`
9	- Building discussion or Pull Request bots on the Hub
10	- Listening for comments on discussions
11	- Auto-retraining models when a dataset is updated
12
13	## Essential Code (USE THIS)
14
15	Hugging Face does not use HMAC signatures. Instead, the secret you configure in the webhook settings is sent verbatim in the `X-Webhook-Secret` header (or as a `?secret=` query parameter). Verify with a timing-safe string comparison.
16
17	### Hugging Face Secret Verification (JavaScript)
18
19	```javascript
20	const crypto = require('crypto');
21
22	function verifyHuggingFaceWebhook(secretHeader, secret) {
23	if (!secretHeader \|\| !secret) return false;
24
25	// Hugging Face sends the secret verbatim — compare directly,
26	// but use timing-safe comparison to prevent timing attacks.
27	try {
28	return crypto.timingSafeEqual(
29	Buffer.from(secretHeader),
30	Buffer.from(secret)
31	);
32	} catch {
33	// Buffers must be same length for timingSafeEqual
34	return false;
35	}
36	}
37	```
38
39	### Express Webhook Handler
40
41	```javascript
42	const express = require('express');
43	const crypto = require('crypto');
44	const app = express();
45
46	// CRITICAL: Use express.json() — Hugging Face sends JSON payloads
47	app.post('/webhooks/huggingface',
48	express.json(),
49	(req, res) => {
50	// Header takes precedence; fall back to ?secret= query parameter
51	const secretHeader = req.headers['x-webhook-secret'] \|\| req.query.secret;
52
53	if (!verifyHuggingFaceWebhook(secretHeader, process.env.HUGGINGFACE_WEBHOOK_SECRET)) {
54	console.error('Hugging Face webhook verification failed');
55	return res.status(401).send('Unauthorized');
56	}
57
58	const { event, repo, discussion, comment, updatedRefs, updatedConfig, webhook } = req.body;
59
60	// event.scope + event.action identifies the event type
61	const key = `${event.scope}.${event.action}`;
62	console.log(`Received ${key} on ${repo.type} ${repo.name}`);
63
64	switch (event.scope) {
65	case 'repo':
66	// create \| update \| delete \| move
67	console.log(`Repo ${event.action}: ${repo.name}`);
68	break;
69	case 'repo.content':
70	// action is always "update"
71	console.log(`Repo content updated on ${repo.name}, refs:`, updatedRefs);
72	break;
73	case 'repo.config':
74	// action is always "update"
75	console.log(`Repo config updated:`, updatedConfig);
76	break;
77	case 'discussion':
78	// create \| update \| delete
79	console.log(`Discussion ${event.action} #${discussion?.num}: ${discussion?.title}`);
80	break;
81	case 'discussion.comment':
82	// create \| update
83	console.log(`Comment ${event.action} by ${comment?.author?.id}`);
84	break;
85	default:
86	// Forward-compatibility: treat narrowed scopes (e.g. repo.config.dois)
87	// as an "update" on the broader scope.
88	console.log(`Unknown scope: ${event.scope} (${event.action})`);
89	}
90
91	res.json({ received: true });
92	}
93	);
94	```
95
96	### Python Secret Verification (FastAPI)
97
98	```python
99	import secrets
100
101	def verify_huggingface_webhook(secret_header: str \| None, secret: str \| None) -> bool:
102	if not secret_header or not secret:
103	return False
104
105	# Hugging Face sends the secret verbatim — timing-safe string comparison.
106	return secrets.compare_digest(secret_header, secret)
107	```
108
109	> For complete working examples with tests, see:
110	> - [examples/express/](examples/express/) - Full Express implementation
111	> - [examples/nextjs/](examples/nextjs/) - Next.js App Router implementation
112	> - [examples/fastapi/](examples/fastapi/) - Python FastAPI implementation
113
114	## Common Event Types
115
116	Hugging Face webhook events are identified by `event.scope` + `event.action`.
117
118	\| `event.scope` \| `event.action` values \| Description \|
119	\|---------------\|----------------------\|-------------\|
120	\| `repo` \| `create`, `update`, `delete`, `move` \| Global events on a repo (model, dataset, Space) \|
121	\| `repo.content` \| `update` \| New commits, branches, or tags. `updatedRefs` is included \|
122	\| `repo.config` \| `update` \| Settings, secrets, DOI, privacy changes. `updatedConfig` is included \|
123	\| `discussion` \| `create`, `update`, `delete` \| Discussion or Pull Request opened, retitled, merged, or closed \|
124	\| `discussion.comment` \| `create`, `update` \| Comment created or

People who liked this also viewed

6 picks

Type