Skip to content

GitHub webhook

Evitrus receives GitHub webhooks on the API and turns them into Evidence Events. You do not host a receiver. This complements the GitHub Actions exporter: the webhook records who opened, approved, and merged; the Action records the build and its image digest. Both carry the commit, so they join one Change.

Requirements

  • Permission to add a webhook on the GitHub organisation or repository
  • The organisation signed in at app.evitrus.io

Connect

  1. In the app, open Integrations and connect GitHub.
  2. Copy the webhook URL and the signing secret. The secret is shown once. Leave the secret field blank to keep the current one, or enter your own before saving.

In GitHub, add the webhook under Organisation → Settings → Webhooks, or under a repository's Settings → Webhooks.

SettingValue
Payload URLThe webhook URL from Integrations
Content typeapplication/json
SecretThe signing secret from Integrations
SSL verificationEnable
EventsLet me select individual events

Subscribe to:

  • Pull requests
  • Pull request reviews
  • Check suites
  • Code scanning alerts

An organisation webhook covers every repository it can see. A repository webhook covers that repository only. GitHub sends a ping when the webhook is created; Evitrus answers it and stores nothing.

Open a test pull request, approve it, and merge. Changes should show build.change.* events for that repository, on the same Change as any Action or deploy events that share the commit.

What it emits

service is the repository name. commitSha comes from the pull request head, the check, or the alert. The acting GitHub user is a human actor. Other actions are acknowledged and produce no event.

GitHub eventConditionEvitrus type
pull_requestopened / reopenedbuild.change.opened
pull_requestclosed and mergedbuild.change.merged
pull_requestclosed without mergebuild.change.closed
pull_request_reviewapprovedbuild.change.approved
pull_request_reviewchanges requestedbuild.change.changes_requested
check_suitesuccess / failuretest.run.passed / test.run.failed
code_scanning_alertcreated / reopened / appeared in branchtest.scan.completed

Evitrus — observability for auditability