Bash script to use on a shared host to handle github commit hook

publish.sh

#!/usr/bin/env bash
# cgi-bin/publish.sh  (chmod +x)

SECRET='THIS IS YOUR SECRET WITH GITHUB'         # <-- set this
SIG_HDR="${HTTP_X_HUB_SIGNATURE_256:-}"          # e.g. sha256=abc123...

# read raw POST body (exact bytes)
BODY="$(dd bs=1 count="${CONTENT_LENGTH:-0}" status=none 2>/dev/null)"

# compute expected signature (hex) over raw body
HEX="$(printf %s "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | sed -E 's/^.*= //')"
EXP="sha256=$HEX"

# simple compare; on mismatch, 403
if [[ "$SIG_HDR" != "$EXP" ]]; then
  printf 'Status: 403 Forbidden\r\nContent-Type: text/plain\r\n\r\nforbidden\n'
  exit 0
fi

# success
printf 'Content-Type: text/plain\r\n\r\nok\n'

cd ..
git pull origin master