Workflows / Github / repository_vulnerability_alert

Github repository_vulnerability_alert Event Notification to Slack & Email

Learn how to listen to the repository_vulnerability_alert webhook event from Github to trigger a notification workflow in MagicBell.

Event payload

Sample payload for the repository_vulnerability_alert event.

{
  "action": "create",
  "alert": {
    "affected_package_name": "example-package",
    "affected_range": "\u003c 2.0.0",
    "created_at": "2025-01-16T18:00:00Z",
    "dismiss_reason": null,
    "dismissed_at": null,
    "dismisser": null,
    "external_identifier": "CVE-2025-12345",
    "external_reference": "https://nvd.nist.gov/vuln/detail/CVE-2025-12345",
    "fixed_in": "2.0.0",
    "ghsa_id": "GHSA-xxxx-yyyy-zzzz",
    "id": 123456789,
    "severity": "high"
  },
  "organization": {
    "avatar_url": "https://avatars.githubusercontent.com/u/111111?v=4",
    "description": "Building great software",
    "id": 111111,
    "login": "acme",
    "node_id": "MDEyOk9yZ2FuaXphdGlvbjExMTExMQ==",
    "url": "https://api.github.com/orgs/acme"
  },
  "repository": {
    "default_branch": "main",
    "full_name": "acme/project",
    "html_url": "https://github.com/acme/project",
    "id": 987654321,
    "name": "project",
    "node_id": "MDEwOlJlcG9zaXRvcnk5ODc2NTQzMjE=",
    "owner": {
      "avatar_url": "https://avatars.githubusercontent.com/u/111111?v=4",
      "html_url": "https://github.com/acme",
      "id": 111111,
      "login": "acme",
      "node_id": "MDEyOk9yZ2FuaXphdGlvbjExMTExMQ==",
      "type": "Organization"
    },
    "private": true
  },
  "sender": {
    "avatar_url": "https://avatars.githubusercontent.com/u/9919?v=4",
    "html_url": "https://github.com/github",
    "id": 9919,
    "login": "github",
    "node_id": "MDEyOk9yZ2FuaXphdGlvbjk5MTk=",
    "type": "Organization"
  }
}

Connect Github to MagicBell to receive events and trigger workflows. This guide uses the MagicBell CLI.

Add the Github integration

Save your Github webhook signing secret in MagicBell. See GitHub webhooks.

magicbell integration save_github \
  --data '{"webhook_signing_secret":"your_secret_here"}'

Copy the ID from the response and use it to build your webhook URL:

https://api.magicbell.com/v2/integrations/github/webhooks/incoming/{id}

Setup the webhook

Add a workflow

Create a workflow that triggers automatically when Github sends this event. Use liquid templates to access fields in your workflow.

Workflow key

Use this key to trigger the workflow when Github sends a repository_vulnerability_alert event:

integration.github.repository_vulnerability_alert

Filter by action: GitHub sends the event type in the header and the action in the payload body. Use an if condition to filter for the create action:

"if": "payload.action == 'create'"

Example workflow

Notify when vulnerability alerts are created for repository dependencies.

{
  "key": "integration.github.repository_vulnerability_alert.create",
  "steps": [
    {
      "command": "broadcast",
      "input": {
        "action_url": "{{payload.repository.html_url}}/security/dependabot",
        "content": "{{payload.alert.severity}} severity vulnerability in {{payload.alert.affected_package_name}} ({{payload.alert.external_identifier}}) affects {{payload.repository.full_name}}. Fixed in: {{payload.alert.fixed_in}}",
        "overrides": {
          "providers": {
            "email": {},
            "slack": {}
          }
        },
        "recipients": [
          {
            "external_id": "security-team"
          }
        ],
        "title": "Vulnerability alert: {{payload.alert.affected_package_name}}"
      }
    }
  ]
}

Save with the CLI

Use the MagicBell CLI to save this workflow to your project. You can also use the Workflows API endpoint instead.

magicbell workflow save \
  --data '{"key":"integration.github.repository_vulnerability_alert.create","steps":[{"command":"broadcast","input":{"action_url":"{{payload.repository.html_url}}/security/dependabot","content":"{{payload.alert.severity}} severity vulnerability in {{payload.alert.affected_package_name}} ({{payload.alert.external_identifier}}) affects {{payload.repository.full_name}}. Fixed in: {{payload.alert.fixed_in}}","overrides":{"providers":{"email":{},"slack":{}}},"recipients":[{"external_id":"security-team"}],"title":"Vulnerability alert: {{payload.alert.affected_package_name}}"}}]}'

Test the workflow

Use the Github CLI to trigger test events and verify your workflow executes correctly.

1. Trigger a test event

Use the GitHub CLI to forward webhook events from your repository to MagicBell:

gh webhook forward \
  --events=repository_vulnerability_alert \
  --url=https://api.magicbell.com/v2/integrations/github/webhooks/incoming/{id}

2. Verify the workflow ran

Check that MagicBell received the event and executed the workflow:

magicbell workflow list_runs --workflow_key integration.github.repository_vulnerability_alert.create

3. Debug issues

If the workflow failed or you need more details, fetch the run to see step-by-step execution:

magicbell workflow fetch_run --run_id {run_id}

Other repository notification workflows

repository

Announce new repositories to the organization.

repository_dispatch

Track custom webhook events triggered via repository dispatch.

repository_import

Notify when repository imports complete.

View all Github workflows →