GitHub App

Org-level webhook receiver that turns GitHub activity into Evidence Events. Complements the GitHub Actions exporter: the App captures governance (who opened / approved / merged, scan findings); the Action captures the build with its image digest.

Prerequisites

• Tenant ingest API key
• Permission to create a GitHub App on the organisation
• A public HTTPS URL for webhooks (dev: https://github.evitrus.dev/webhook)

Create the GitHub App

1. GitHub → Organisation → Settings → Developer settings → GitHub Apps → New
2. Or start from app-manifest.json via the manifest flow.

Configure:

Setting	Value
Webhook URL	https://github.evitrus.dev/webhook (dev) or your deployed host /webhook
Webhook secret	Strong random string (also set as GITHUB_WEBHOOK_SECRET)
Permissions (read)	Pull requests, Checks, Code scanning alerts, Metadata
Events	Pull request, Pull request review, Check suite, Code scanning alert

Install the App on the repositories you want covered.

Deploy the receiver

The receiver is a small Go service (Helm chart under exporter/github-app):

helm install evitrus-github-app ./chart \
  --namespace evitrus --create-namespace \
  --set ingest.url=https://api.evitrus.dev/ingest \
  --set ingest.apiKey=<your-tenant-key> \
  --set github.webhookSecret=<your-webhook-secret>

Environment variables (if not using Helm values):

Variable	Required	Notes
EVITRUS_API_KEY	yes	Tenant ingest key
EVITRUS_INGEST_URL	no	Defaults to local stack
GITHUB_WEBHOOK_SECRET	strongly recommended	Empty disables signature checks
PORT	no	Default 8090

Endpoints: POST /webhook, GET /healthz.

What it emits

GitHub event	Condition	Evitrus type
pull_request	opened / reopened	build.change.opened
pull_request	closed and merged	build.change.merged
pull_request	closed without merge	build.change.closed
pull_request_review	approved	build.change.approved
pull_request_review	changes requested	build.change.changes_requested
check_suite	success / failure	test.run.passed / test.run.failed
code_scanning_alert	created / reopened / …	test.scan.completed

service is the repository name; commitSha comes from the PR head / check / alert. Ingest still accepts the older pr.* / build.succeeded / security.scan names as aliases.

Verify

Open a test PR, approve, and merge. In Evitrus you should see build.change.* events for that repository correlated with any Action / deploy events that share the commit.