Repository-Webhooks vs Github Apps - which to use?

Question

UseCase: My current use case is to react on new Issues and post automatic comments. This is mainly specific to one or two repositories.

Thus I guess webhooks on a repository as well as Github Apps can be used. Although Github has some really good documentation on both, I'm unsure which one to use for my scenario.

What advantages / disadvantages do they have when compared?

• One advantage of Github Apps is that they don't need to add a WebHook to the repository according to this answer. - Not sure why that is an advantage.
• Obviously a GitHub App can be installed in different repositories and also published in the marketplace. But I could also use the same URL for Webhooks in different repositories and thus mimmic that behavior with repository-webhooks to a certain extend.
• What else?

Footpath

Answer 1

The main difference is that while webhooks generate events and send them to a given URL Github. Apps have the right to access the repositories where you install them based on the permissions you give them.

If you have a webhook that fires every time an issue is updated you will receive an event at the URL you specified, but you will not have any rights to e.g. modify that issue in Github (e.g. through an API call).

If you instead have a Github App installed in your repository and the webhook URL set in the App settings, then the event will be sent to the URL as well. However, here's the difference: behind the webhook URL you will probably have a service that uses the Github App credentials (private key or temporary tokens) to make some modifications to your Github repo.

An example:

• Webhook -> logging of Pull Request changes
• Github App -> automate tagging of new pull requests

Gaiser

Answer 2

What else?

You can also use GitHub Actions. For your use case, there is the issues event (which is actually a webhook). It has several activity types, including opened:

on:
  issues:
    types: opened

This workflow only runs when an issue is created. Afterwards, you can use the REST API (e.g. via curl) to GET the newest issue and POST a comment.

As you said this is only relevent for "one or two repositories", I think it is fine to just copy & paste that workflow. If the number of repos grows, you may want to create a dedicated action.

Speaking of custom actions, there is also an existing Auto Comment action:

on: issues
jobs:
  run:
    runs-on: ubuntu-latest
    steps:
      - uses: bubkoo/auto-comment@v1
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          issuesOpened: >
            Your issue comment goes here.

Symphysis