Before
Teams likely had to review GitHub events manually, determine whether each event required attention, and notify the appropriate people with the actor and affected resource details. For approved cleanups, an operator then had to switch to GitHub and perform the removal, deletion, or visibility change.
How it works
- Receive a GitHub event, identify the actor, and classify it as repository or organization activity.
- Send a severity-based Slack alert with the relevant repository, team, or user information and present the appropriate Yes or No decision.
- If approved, execute the matching remediation in GitHub; otherwise, stop after notification without applying the change.
Workflow details
- Event intake and context: A GitHub event received through the emailhook starts the workflow, which identifies the user who performed the action and routes the event using its event type and action.
- Repository monitoring: Repository creation and forks generate low-severity Slack alerts, while a repository becoming public generates a high-severity alert. Repository creation and public-visibility events also include the repository name and URL and present an approval choice for deletion or privacy protection.
- Organization monitoring: User invitations and team creation generate high-severity Slack alerts containing the actor and affected user or team. Each event presents a decision about whether the user or team should be removed.
- Human approval: The workflow does not automatically perform the potentially disruptive action immediately. It presents Yes or No controls in the alert so an authorized person can approve or decline the proposed cleanup or privacy change.
- Remediation and handoff: An approved decision removes an organization membership, deletes a team, deletes a repository, or changes a repository to private, depending on the event. Fork events remain notification-only, giving the team visibility without an automated destructive action.
What changed
GitHub activity is now classified and surfaced in Slack as it arrives, with event-specific details and a built-in approval handoff. Human approval remains required for disruptive actions, but the approved remediation is executed automatically in the matching GitHub context.
Work removed
Manually reviewing supported GitHub events one by one, identifying the actor and affected resource, composing and routing Slack alerts, switching to GitHub to remove organization memberships or teams, deleting repositories, and changing repository visibility to private.
Expected outcome
A reasonable conservative expectation is one manual triage-and-notification cycle removed for each supported event, with approved cases also avoiding a separate manual execution handoff.
