only deploy if the hmac is correctly signed (payload) from github