Track code scanning alerts in Gong
Make security work visible without another dashboard to remember.
Trigger
New Code Scanning Alert Created
Triggers when a new code scanning alert is created in a repository. Fires an event for each newly created code scanning alert detected in the configured repository. Alerts can be filtered by Git reference, scanning tool, state, and severity. The payload includes the alert number, rule details, tool information, state, severity, and the location of the most recent instance.
Action
Report Custom Engagement Event
Push engagement events into gong and display them as events in gong’s activity timeline, when a content is engaged by an external participant (for example, a contract was “signed” by the prospect) when accessed through a bearer token authorization method, this endpoint requires the scope 'api:engagement-data:write'.
Why this helps
Code scanning findings are easy to postpone because they live apart from the conversations driving priorities.
- Adds security findings to a searchable timeline
- Keeps severity and tool context visible
- Supports better prioritization conversations
Setup
Build it in a few focused steps.
- 1Connect GitHub and Gong to Notis once through the portal.
- 2Create the automation in Automations or ask Notis directly.
- 3In one instruction, ask Notis to record each new code scanning alert in Gong with severity, rule, tool, and repository context.
- 4Pick the code scanning alert trigger and choose the run-report channel.
- 5Test with one real alert.
Questions about this workflow
Can severity be included?
Yes. Notis can include the alert severity and rule details in the event.
Will every alert create a separate event?
The trigger fires for each newly created alert.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link GitHub to Gong. A trigger fires from one place; an action lands in another.
GitHub triggers
Gong actions
New Workflow Artifact Created
Triggers when a new workflow artifact is created in a GitHub repository. Monitors for newly created GitHub Actions workflow artifacts. Optionally filters by artifact name to restrict monitoring to specific artifacts.
Add call media v2 calls id media
Adds a call media, recorded by a telephony system (pbx) or other media recording facility. gong accepts call recordings in various audio and video file formats, including wav, mp3, mp4, mkv and flac. if uploading a dual-channel (stereo) file separated by speaker, make sure to specify which channel correspondsto the company team member (rep) in the parties/mediachannelid parameter of the add new call operation. when accessed through a bearer token authorization method, this endpoint requires the scope 'api:calls:create'.
Branch Changed
Triggers when a GitHub branch changes. Monitors a specific branch for: - New commits pushed (head commit SHA changes) - Protection status toggled (branch becomes protected or unprotected) - Protection settings changed, including: required status checks and their enforcement level, admin enforcement, required pull request reviews (dismiss stale reviews, code owner reviews, approving review count, last push approval), required linear history, force push allowance, deletion allowance, conversation resolution, branch locking, and fork syncing.
Add new call v2 calls
When using this endpoint, either provide a downloadmediaurl or use the returned callid in a follow-up request to /v2/calls/{id}/media to upload the media file. when accessed through a bearer token authorization method, this endpoint requires the scope 'api:calls:create'.
New Branch Created
Triggers when a new branch is created in a GitHub repository. Detects newly created branches. Deleted branches do not fire events.
Aggregate activity by period via api
Lists the aggregated activity of multiple users within the gong system for each time period within the defined date range. this endpoint returns multiple records, one for each user. for each user there are items for every time period in the date range, including statistics about the user's activity. records are returned only for users with activity in the range. when accessed through a bearer token authorization method, this endpoint requires the scope 'api:stats:user-actions'.
Check Run Status / Conclusion Changed
Triggers when a specific GitHub check run changes its status or conclusion. Monitors a single check run for changes to: status (queued, in_progress, completed, etc.), conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required), started_at, and completed_at.
Aggregate user activity statistics
Lists the activity of multiple users within the gong system during a defined period. given the period, this endpoint returns multiple records, one for each user, with an applicable activity during the period. each record includes statistics about the user's activity. when accessed through a bearer token authorization method, this endpoint requires the scope 'api:stats:user-actions'.
Check Suite Status / Conclusion Changed
Triggers when a GitHub check suite changes its status or conclusion for a given ref. Monitors all check suites associated with a git reference (branch, tag, or commit SHA) for changes to status (queued, in_progress, completed, etc.) and conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required, startup_failure, stale). Optionally filters by GitHub App ID.
Assign prospects to flow
Use this endpoint to assign a number of prospects to a flow. prospects can be contacts or leads in your crm. generate a list of comma separated crm ids of the prospects you want to add to a flow. the flowinstanceowneremail parameter is the email address of the gong user who set up the flow instance and owns the flow to-dos. you can assign up to 200 prospects to a flow in a single request. when accessed through a bearer token authorization method, this endpoint requires the scope 'api:flows:write'.
New Code Scanning Alert Created
Triggers when a new code scanning alert is created in a repository. Fires an event for each newly created code scanning alert detected in the configured repository. Alerts can be filtered by Git reference, scanning tool, state, and severity. The payload includes the alert number, rule details, tool information, state, severity, and the location of the most recent instance.
Create activity scorecards report
Retrieve all the answers for the scorecards that were reviewed during a specified date range, for calls that took place during a specified date range, for specific scorecards or for specific reviewed users. when accessed through a bearer token authorization method, this endpoint requires the scope 'api:stats:scorecards'.
New Repository Collaborator Added
Triggers when a new collaborator is added to a GitHub repository. Monitors the full list of collaborators on a repository and fires an event for each newly added collaborator. The payload includes the collaborator's GitHub username, account ID, profile URL, avatar URL, permission flags (pull, triage, push, maintain, admin), and assigned role name.
Create a new gong meeting v2 meetings
When accessed through a bearer token authorization method, this endpoint requires the scope 'api:meetings:user:create'.
Commit Event
Triggered when a new commit is pushed to a repository.
Create permission profile v2 permission profile
Create a permission profile in a given workspace.
Connect any two apps with Notis in the middle.
Not just GitHub and Gong. Any combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7 days free trial with 20$ free usage included.
No card. Works with personal or business Gong.