GitHub (releases, PRs, deploys, security) webhook
Published releases, review requests, failed deployments and checks, and Dependabot alerts.
Setup
- In PingLoom open Webhooks, choose New webhook source, pick GitHub and create it. Copy the endpoint URL and the signing secret. The secret is shown once.
- In GitHub open the repository, then Settings, Webhooks, Add webhook. For every repository in an organization use the organization's Settings, Webhooks instead.
- Paste the endpoint URL into Payload URL, set Content type to application/json and paste the signing secret into Secret.
- Choose Let me select individual events and tick Releases, Pull requests, Deployment statuses, Check suites, Dependabot alerts and Security advisories. Tick Check runs or Pushes only if you want those too.
- Click Add webhook. GitHub sends a ping, which PingLoom answers with ignored.
Verification
GitHub signs the raw body with HMAC-SHA256 and the secret you set, and sends it as sha256=<hex> in X-Hub-Signature-256. PingLoom uses the X-GitHub-Delivery header to drop repeats. This is separate from the GitHub Actions template, which only covers finished workflow runs.
Events
You choose which events become alerts when you create the source, and you can change it later on the source page.
| Event | Priority | On by default |
|---|---|---|
| Release published | normal | Yes |
| Pull request: review requested | normal | Yes |
| Pull request opened against the default branch | normal | Yes |
| Deployment failed or errored | high | Yes |
| Check suite failed | high | Yes |
| Check run failed (one alert per check) | high | No |
| Push to the default branch | low | No |
| Dependabot alert created | high | Yes |
| Security advisory published | high | Yes |
PingLoom keeps the repository, tag or number, branch and a short commit id. User names and emails are never copied.
GitHub's security_advisory event fires with the action published; there is no created action.