Shut down Codemagic previews when GitHub finds a secret
Contain exposure quickly while the alert is still new, then report the action where your team will see it.
Trigger
New Secret Scanning Alert Detected
Triggers when a new secret scanning alert is detected in a GitHub repository. Monitors open secret scanning alerts and fires an event for each newly detected alert. Supports filtering by secret type (e.g., personal access tokens, AWS keys) and by token validity status (active, inactive, unknown). The payload includes the alert number, secret type, validity status, resolution state, timestamps, URLs, and flags for push protection bypass, public exposure, and multi-repo detection.
Action
Stop Preview
Tool to stop an app preview. Use when you need to stop a running app preview by its identifier.
Why this helps
A leaked credential can demand several urgent actions at once, making it easy to forget a live preview.
- Stops the identified preview without waiting for manual cleanup
- Reduces the number of steps in an incident response
- Creates a visible record of the containment action
Setup
Build it in a few focused steps.
- 1Connect GitHub and Codemagic to Notis once.
- 2Create an automation in the portal or tell Notis the response you want.
- 3Write one instruction such as: “When GitHub detects a new active secret alert for the preview repository, stop the associated Codemagic app preview and report what happened.”
- 4Select New Secret Scanning Alert Detected, choose an urgent report channel, and test with a safe controlled example.
Questions about this workflow
Does this rotate the exposed credential?
No. This workflow stops the preview; credential revocation and rotation should remain part of your incident process.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link GitHub to Codemagic. A trigger fires from one place; an action lands in another.
GitHub triggers
Codemagic actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Add Application from Private Repository
Tool to create an application from a private repository using SSH key authentication. Use when you need to add a new private repository to Codemagic with SSH credentials.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Add New Application
Tool to add a Git repository to the applications list in Codemagic. Use when you need to add a new application to Codemagic from a repository URL.
New Workflow Artifact Created
Triggers when a new workflow artifact is created in a GitHub repository. Monitors for newly created GitHub Actions workflow artifacts. Optionally filters by artifact name to restrict monitoring to specific artifacts.
Get Meta Information
Tool to get metadata about Codemagic including public IP addresses in use (in CIDR notation). Use when you need to retrieve IP blocks for whitelisting build machines or simulator network requests.
Branch Changed
Triggers when a GitHub branch changes. Monitors a specific branch for: - New commits pushed (head commit SHA changes) - Protection status toggled (branch becomes protected or unprotected) - Protection settings changed, including: required status checks and their enforcement level, admin enforcement, required pull request reviews (dismiss stale reviews, code owner reviews, approving review count, last push approval), required linear history, force push allowance, deletion allowance, conversation resolution, branch locking, and fork syncing.
Get Variable Group Information
Tool to retrieve information about a specific variable group including its name and configuration settings. Use when you need to get details for a variable group by its ID.
New Branch Created
Triggers when a new branch is created in a GitHub repository. Detects newly created branches. Deleted branches do not fire events.
Update Variable Group
Tool to change a variable group's name and security settings. Use when you need to update an existing variable group by its ID. Returns success confirmation on 204 No Content response.
Check Run Status / Conclusion Changed
Triggers when a specific GitHub check run changes its status or conclusion. Monitors a single check run for changes to: status (queued, in_progress, completed, etc.), conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required), started_at, and completed_at.
Delete All Application Caches
Tool to delete all caches for a specific application. Use when clearing all cached data for an app. The deletion process is asynchronous and will complete after the API response is returned.
Check Suite Status / Conclusion Changed
Triggers when a GitHub check suite changes its status or conclusion for a given ref. Monitors all check suites associated with a git reference (branch, tag, or commit SHA) for changes to status (queued, in_progress, completed, etc.) and conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required, startup_failure, stale). Optionally filters by GitHub App ID.
Delete Specific Cache
Tool to delete a specific cache from an application. Use when a cached build artifact needs to be removed. The deletion is performed asynchronously and returns immediately with a 202 Accepted status.
New Code Scanning Alert Created
Triggers when a new code scanning alert is created in a repository. Fires an event for each newly created code scanning alert detected in the configured repository. Alerts can be filtered by Git reference, scanning tool, state, and severity. The payload includes the alert number, rule details, tool information, state, severity, and the location of the most recent instance.
Get Account Info for Over-the-Air Updates
Tool to retrieve account information for over-the-air updates. Use when you need to check the account status (enabled/disabled/pending) and associated team identifier.
Connect any two apps with Notis in the middle.
GitHub and Codemagic, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Codemagic.