Skip to content

feat: add huggingface-webhooks skill#44

Merged
leggetter merged 3 commits into
mainfrom
feat/huggingface-webhooks
May 11, 2026
Merged

feat: add huggingface-webhooks skill#44
leggetter merged 3 commits into
mainfrom
feat/huggingface-webhooks

Conversation

@leggetter
Copy link
Copy Markdown
Collaborator

Summary

Adds a complete huggingface-webhooks provider skill for Hugging Face Hub webhooks. Uses shared-token verification (NOT HMAC) via the X-Webhook-Secret header.

What's included

  • skills/huggingface-webhooks/SKILL.md — entry point
  • skills/huggingface-webhooks/references/ — overview, setup, verification (timing-safe comparison of the verbatim secret)
  • skills/huggingface-webhooks/examples/ — Express, Next.js, FastAPI handlers
  • Coverage for all five documented scopes plus forward-compatibility for narrowed unknown scopes

Notes

  • Verification scheme: timing-safe string comparison of X-Webhook-Secret header against configured secret (NOT HMAC — the secret is sent verbatim)
  • Alternative: ?secret= query parameter on the handler URL (for environments where reading headers is hard)
  • Scopes covered: repo, repo.content, repo.config, discussion, discussion.comment, with actions create/update/delete/move
  • Forward-compat fallback: unknown narrowed scopes default to update on the broader scope (per the docs' guidance)
  • Rate limit: 1,000 triggers per 24h
  • Payload includes event.scope, event.action, repo, optional discussion, comment, updatedRefs, updatedConfig, and webhook (with version)

Test plan

  • cd skills/huggingface-webhooks/examples/express && npm test
  • cd skills/huggingface-webhooks/examples/nextjs && npm test
  • cd skills/huggingface-webhooks/examples/fastapi && pytest test_webhook.py -v
  • Verify timing-safe comparison handles same-length / different-length secret mismatches
  • Confirm scope/action enum matches https://huggingface.co/docs/hub/webhooks

Generation details

https://claude.ai/code/session_01NNTgQRJss1V7gyzzJ9rjnB


Generated by Claude Code

@leggetter leggetter marked this pull request as ready for review May 11, 2026 21:41
leggetter added a commit that referenced this pull request May 11, 2026
PRs for discord/claude-managed-agents/gemini merged ahead of this one and
added rows/entries to README.md and providers.yaml at the same
alphabetical neighbourhood. Re-pushed the resolved files so PR #44 stays
mergeable.

https://claude.ai/code/session_01NNTgQRJss1V7gyzzJ9rjnB
claude and others added 3 commits May 11, 2026 23:04
…dling

Adds SKILL.md, references (overview, setup, verification), and Express,
Next.js, and FastAPI examples with passing tests. Verification uses
timing-safe comparison of the verbatim X-Webhook-Secret header (with
?secret= query parameter as a fallback), covering all five documented
scopes (repo, repo.content, repo.config, discussion, discussion.comment)
plus forward-compatibility for unknown narrowed scopes.

https://claude.ai/code/session_01NNTgQRJss1V7gyzzJ9rjnB
Adds the Hugging Face row to the Provider Skills table in README.md and
a providers.yaml entry (docs URLs, notes, testScenario) so the
"Validate New Provider" CI workflow finds the integration files. The
integrations were previously only on the prep branch (PR #40); moving them
onto each feat PR makes the 12 generated PRs independently mergeable in
any order.

https://claude.ai/code/session_01NNTgQRJss1V7gyzzJ9rjnB
… source arg

Applies the new project convention from PR #40: use
`npx hookdeck-cli listen <port> <source> --path /webhooks/<source>`
everywhere instead of `hookdeck listen <port> --path /webhooks/<source>`.
Skips the global-install prereq (webhook-skills is provider-neutral) and
passes the required `[source]` positional so the command is copy-paste-
runnable without falling into an interactive prompt.

https://claude.ai/code/session_01NNTgQRJss1V7gyzzJ9rjnB
@leggetter leggetter force-pushed the feat/huggingface-webhooks branch from 8257b0e to 11b2b0e Compare May 11, 2026 22:08
@leggetter leggetter merged commit 0bddb18 into main May 11, 2026
6 checks passed
@leggetter leggetter deleted the feat/huggingface-webhooks branch May 11, 2026 22:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants