Connect GitHub
Send a GitHub organization's repository, protection, deploy key, membership, and secret scanning events to a source.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
You need to be an owner of the GitHub organization. Nothing is installed in it: GitHub sends the events, signed with a secret you share.
1. Create the source
In ShellOrbit, Settings, Integrations, Add source, choose GitHub, and name it after the organization. Copy the URL and the secret.
2. Add the organization webhook
In GitHub, open the organization, then Settings, Webhooks, Add webhook:
| Field | Value |
|---|---|
| Payload URL | The source URL, https://hooks.shellorbit.com/e/... |
| Content type | application/json |
| Secret | The source secret |
| SSL verification | Enabled |
| Which events | Let me select individual events |
Select these events, which the ready-made rules read: Branch protection rules, Deploy keys, Organizations, Repositories, Repository rulesets, and Secret scanning alerts. Anything else is stored and can feed your custom rules, but counts against your source events.
Save. GitHub sends a ping event straight away; it shows in the source’s events with a passing signature.
What the ready-made rules detect
| Finding | Severity | GitHub event |
|---|---|---|
| Secret scanning alert | Critical | secret_scanning_alert, created |
| Repository made public | High | repository, publicized |
| Repository deleted | High | repository, deleted |
| Branch protection rule deleted | High | branch_protection_rule, deleted |
| New organization owner | High | organization, a member added or changed to the admin role |
| Repository ruleset deleted | Medium | repository_ruleset, deleted |
| Deploy key added | Medium | deploy_key, created |
Each finding names the repository or member and who did it. Switch any rule off for this source on its page.
Signature
GitHub signs each delivery with X-Hub-Signature-256, an HMAC SHA256 of the body with your secret. ShellOrbit checks it on the original bytes. A failing check usually means the secret in GitHub and in ShellOrbit differ: paste it again, or rotate it on the source and update GitHub.
Leaked GitHub tokens
Separately, Leak Alarm finds personal access tokens in browser bundles and logs, and on Pro and Business reports a leaked one to GitHub to be revoked. Revoke and undo