"Signature does not match event payload and secret" error

Bug Report

Current Behavior I don’t think this is a bug within Probot necessarily (maybe the GitHub API itself), but I began getting numerous “Signature does not match event payload and secret” errors, always when my GitHub app received a payload sent from another bot (e.g. renovate as shown in the payload below).

Example payload (let me know if you need the full thing)

{
  "action": "edited",
  "number": 12,
  "pull_request": {
    "url": "https://api.github.com/repos/yanrs17/chat-app/pulls/12",
    "id": 235266303,
    "node_id": "MDExOlB1bGxSZXF1ZXN0MjM1MjY2MzAz",
    "html_url": "https://github.com/yanrs17/chat-app/pull/12",
    "diff_url": "https://github.com/yanrs17/chat-app/pull/12.diff",
    "patch_url": "https://github.com/yanrs17/chat-app/pull/12.patch",
    "issue_url": "https://api.github.com/repos/yanrs17/chat-app/issues/12",
    "number": 12,
    "state": "open",
    "locked": false,
    "title": "Update Node.js to v6.17.1",
    "user": {
      "login": "renovate[bot]",
      "id": 29139614,
      "node_id": "MDM6Qm90MjkxMzk2MTQ=",
      "avatar_url": "https://avatars1.githubusercontent.com/in/2740?v=4",
      "gravatar_id": "",
      "url": "https://api.github.com/users/renovate%5Bbot%5D",
      "html_url": "https://github.com/apps/renovate",
      "followers_url": "https://api.github.com/users/renovate%5Bbot%5D/followers",
      "following_url": "https://api.github.com/users/renovate%5Bbot%5D/following{/other_user}",
      "gists_url": "https://api.github.com/users/renovate%5Bbot%5D/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/renovate%5Bbot%5D/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/renovate%5Bbot%5D/subscriptions",
      "organizations_url": "https://api.github.com/users/renovate%5Bbot%5D/orgs",
      "repos_url": "https://api.github.com/users/renovate%5Bbot%5D/repos",
      "events_url": "https://api.github.com/users/renovate%5Bbot%5D/events{/privacy}",
      "received_events_url": "https://api.github.com/users/renovate%5Bbot%5D/received_events",
      "type": "Bot",
      "site_admin": false
    }
    ...
}

I chatted with @gr2m about this on Twitter awhile back, but we never got to any conclusions, so I thought I would open this issue for tracking.

Expected behavior/code No errors from other GitHub bots

Environment

• Probot version(s): 9.6.6
• Node/npm version: [e.g. Node 8/npm 5] Node 10
• OS: [e.g. OSX 10.13.4, Windows 10] Heroku Deployment

[bdurrani]

I’m running into the same issue. I used the starting project tool npx create-probot-app my-first-app. It looks like the tool sets up the private key and webhook secret already.

The reproduction steps for this is just to run the tool that sets up the project, make the app active so we can start receiving hooks. To make the webhooks active, github requires to put in a valid value for the User authorization callback URL. I just put it to github.com` for now.

I’m not sure what I’m supposed to put in there. I’m not sure what I’m supposed to do next. I know I’m probably missing a step. Thanks for your help

[gr2m]

Please test again with Probot v10. It did occur to me again in the WIP app using Probot v10 , but less frequently, and I want to make sure it’s not something specific to the WIP app.