secure webhook for using git to deploy

build-staging.sh

#!/bin/sh

cd /var/www/site-staging && git reset --hard && git pull -f origin staging 
echo ok

git-web-hook.php

<?php
function run($branch, $buildCommand, $envKey) {
	$data = json_decode(file_get_contents('php://input'), true);
	$key = getenv($envKey);

	if (verify($data, $key)) {
		$ref = $data['ref'];
		$foundBranch = explode('/', $ref)[2];

		if ($foundBranch == $branch) {
            shell_exec($buildCommand);
		}
	}
}

function verify($payload, $key) {
    $expected = $_REQUEST['HTTP_X_HUB_SIGNATURE'];
    $actual = sprintf("%s%s", 'sha1=', hash_hmac('sha1', $payload, $key));
    return safeEquals($expected, $actual);
}

function safeEquals($a, $b) {
    return substr_count($a ^ $b, "\0") * 2 === strlen($a . $b);
}

$branch = 'staging';
$buildScript = '/usr/local/bin/build-staging.sh'; 
$envKey = 'secret_token_github';

run($branch, $buildScript, $envKey);