git-payload.php

<?php
define('UPDATE_WEBSITE_SH', '/path/to/update-website.sh');

if (!(isset($_SERVER['HTTP_USER_AGENT']) && preg_match('/GitHub Hookshot/i', $_SERVER['HTTP_USER_AGENT']))) {
  die();
}
if (!file_exists(UPDATE_WEBSITE_SH)) {
  die();
}
if ( !isset($_POST['payload']) ) {
  die();
}

$payload = json_decode($_POST['payload']);
$dirname = dirname(__FILE__);
$output = exec( '/bin/sh ' . UPDATE_WEBSITE_SH . ' ' . $dirname );
echo $output . "\n";

I would really check the IP address before trusting something like this. It's a DOS dream.