
How to Use Webhooks to Trigger Shell Scripts the Safe Way
Trigger a shell script from a webhook safely: verify the HMAC signature, avoid passing request data to the shell, lock down the user, and respond fast.
Tag
12 posts

Trigger a shell script from a webhook safely: verify the HMAC signature, avoid passing request data to the shell, lock down the user, and respond fast.

Cache API responses in shell scripts: a keyed file cache with a TTL, conditional requests with ETag, atomic writes, stale fallback and what not to cache.

Handle API timestamps and time zones in scripts: ISO 8601 in UTC, epoch seconds versus milliseconds, GNU and BSD date, jq and daylight saving traps.

Upload and download large files through APIs with curl: stream, resume, retry, multipart and pre-signed URLs, size limits, checksums and progress.

Avoid repeated API calls in scripts: fetch once, pass data along, conditional requests with ETags, batching, pagination limits and a request counter.

Query a GraphQL API from the command line with curl, jq and gh api graphql: build JSON safely, use variables, introspect, paginate and check errors.

Use an OpenAPI spec from the command line: list endpoints with jq, lint with Redocly, call APIs with restish, mock with Prism and diff versions.

Compare curl, HTTPie and xh for API work: JSON request syntax, output formatting, sessions, speed, availability and which fits scripts.

The HTTP status codes developers actually meet, grouped by meaning, with what scripts should do for each, retries, redirects and curl options.

REST, RPC and GraphQL compared: resources versus actions versus queries, caching, versioning, tooling with curl, error handling and how to choose.

Trigger CI from Git hooks and webhooks the right way: server-side post-receive, host webhooks, API dispatch calls, authentication and safe retries.

Keep API keys out of scripts and repositories: env files, secret managers, scanning for leaks, narrow scopes and what to do after a key escapes.