Before
Teams likely had to inspect GitHub activity, identify the event and responsible user, and manually compose notifications for the appropriate channel. When remediation was needed, an administrator had to switch to GitHub, locate the affected user, team, or repository, confirm the intended action, and execute it separately.
How it works
- Receive a GitHub webhook, look up the initiating user, and classify the event by type and action.
- Send a severity-labeled Slack alert with the actor and affected resource, including an approval prompt for supported remediation scenarios.
- If approved, execute the corresponding administrative action in GitHub, such as removing membership, deleting a team or repository, or making a repository private.
Workflow details
- Event intake and identity lookup: The workflow begins when a GitHub webhook is received, then retrieves the user who performed the action so alerts can include a recognizable actor alongside the affected resource.
- Event classification: It evaluates the webhook event type and action to distinguish organization activity, team creation, repository creation, repository forks, and repositories made public.
- Alert delivery: Each supported event is formatted into a severity-labeled Slack notification containing relevant details such as the user, team, repository name, repository URL, or fork information.
- Approval-based remediation: For organization invitations, team creation, repository creation, and repositories made public, the notification includes Yes/No actions so a person can approve removing a user, deleting a team or repository, or changing a public repository to private.
- Controlled execution: When the response is Yes, the workflow performs the selected GitHub administrative action; a No response leaves the event without that remediation while still preserving the alert and human decision point.
What changed
GitHub activity is now classified and reported automatically with standardized context and severity. Human approval remains required for the configured destructive or privacy-related actions, but the approved handoff executes the selected GitHub change directly instead of requiring a separate manual lookup and action.
Work removed
Manually reviewing supported webhook events one by one, identifying the initiating user, choosing the correct alert format, copying repository or team details into a message, switching to GitHub to locate the affected resource, and repeating the approved administrative action.
Expected outcome
A conservative expectation is the removal of at least one manual routing and notification-composition cycle for every supported webhook event, with one approval-driven administrative action available when remediation is required.
