Alert on unauthorized GitHub repo access and pushes

Watches your GitHub org for risky changes and pings Slack the moment someone unauthorized takes action.

How the work actually flows

It branches. Exactly one path is taken; runs once per one per activity event.

Pattern: Exclusive Choice (4) · Multiple Instances without Synchronization (12)

flowchart TD trig(["periodic github activity check"]):::trigtime s0[["identify event type"]]:::mi s1["flag if unauthorized"]:::task s2["send slack alert"]:::svc trig --> s0 s1 --> s2 gx{"× what type of event occurred"}:::gate s0 --> gx p00["check against admin whitelist"]:::task gx -->|"access or role change"| p00 p10["check against approved whitelist"]:::task gx -->|"push event"| p10 jn{"○ flag if unauthorized"}:::gate p00 --> jn p10 --> jn jn --> s1 out[/"slack alert for unauthorized action"/]:::out pay{{"faster response to security risk"}}:::pay s2 --> out out --> pay classDef task fill:#e7f6fe,stroke:#34b8f0,color:#2c2a29 classDef svc fill:#f6f8fa,stroke:#7c8795,color:#2c2a29 classDef mi fill:#e7f6fe,stroke:#0079a8,color:#2c2a29,stroke-width:2px classDef human fill:#fff,stroke:#0079a8,color:#0079a8 classDef store fill:#f6f8fa,stroke:#0079a8,color:#2c2a29 classDef trig fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigtime fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigdata fill:#8ad4f5,stroke:#0079a8,color:#06314c,font-weight:bold classDef gate fill:#fff,stroke:#e8a23d,color:#6b4708,font-weight:bold classDef out fill:#1f9d6b,stroke:#167a53,color:#fff,font-weight:bold classDef pay fill:#06314c,stroke:#021f33,color:#fff
Starts itA stepAn outside serviceRuns once per itemOne path onlyPaths rejoinResultPayoff
Build size
Advanced

A larger build with multiple systems, AI reasoning, and custom rules.

Business functions
Messaging & Notifications
Connects
GitHubSlack

The problem it solves

You can't watch every commit and permission change across your repositories all day, but one bad push or unauthorized access change can be a real security problem. By the time someone notices manually, the damage may already be done.

Who it fits

Engineering managers or security-conscious teams responsible for repository access control.

How it works

  1. The system periodically checks GitHub for repo access changes and push activity
  2. Each event's user is checked against an approved whitelist of roles
  3. Actions taken by non-admin users, like changing repo visibility or membership, are flagged
  4. Push events from users not on the whitelist are flagged as unknown
  5. Any flagged event triggers an immediate Slack alert with the details
What you get

Risky repo changes you hear about immediately

Get an instant Slack alert the moment someone outside your approved list changes repo access or pushes code to GitHub.

What you get

A Slack alert whenever someone takes a high-risk GitHub action they're not authorized for.

What you need

A GitHub account with a personal access token and a Slack workspace with a bot token.

We can build this. But should you?

The hard question is not how to build it. It is whether this is the right thing to build first.

That is what a Fractional Chief AI Officer figures out with you, before anyone writes a line of code.

Let's Talk Strategy

Related automations

Back to the AI Playbook