Skip to main content
Pull request triggers run automations automatically when pull request events occur. Respond to code changes, reviews, and merges without manual intervention.
Pull request triggers currently support GitHub and GitLab only. Bitbucket support is not available at this time.

​
What are pull request triggers

Pull request triggers execute automations based on pull request activity in your repositories. The automation runs when specific events happen, such as opening a PR, updating code, or merging changes. Use pull request triggers for:
  • Automated code reviews and analysis
  • Security scanning on new code
  • Documentation updates when APIs change
  • Compliance checks before merge
Best practice: Run pull request automations as a service account rather than a personal user account. This is ideal for tracking large-scale changes or recurring automations, as all activity (commits, pull requests, comments) appears under a dedicated SCM account associated with the service account, making it easy to audit and differentiate automation work from human work.

​
Configure pull request triggers

When creating an automation with a pull request trigger, configure the target scope and events:

​
Target scope

Choose where the automation runs: Target projects:
  1. Select Projects as the target type
  2. Choose one or more projects from the list
  3. The automation monitors all repositories within those projects
Target repositories:
  1. Select Repositories as the target type
  2. Select an environment class for the automation to use
  3. Enter a search query to filter repositories (see Manual Triggers for search examples)
Pull request trigger configuration with target selection

​
Select events

Choose which pull request events trigger the automation. You can select one or multiple events:
  • Opened - When a new pull request is created
  • Updated - When new commits are pushed to the pull request
  • Ready for review - When a draft pull request is marked ready for review
  • Approved - When a reviewer approves the pull request
  • Merged - When the pull request is merged into the target branch
  • Closed - When the pull request is closed without merging
Example combinations:
  • Opened + Updated - Run checks on every code change
  • Ready for review - Run comprehensive analysis before human review
  • Approved - Run final validation before merge

​
Set up webhook configuration

After saving your automation, configure webhooks in GitHub or GitLab to send events to Ona. Note: Webhook configuration is only available after saving the automation. This is a current limitation.

​
Access webhook details

  1. Save your automation
  2. Open the automation details page
  3. Navigate to the Configuration section
You’ll see:
  • Payload URL - The endpoint to send webhook events
  • Secret - Authentication token for webhook requests
  • Content type - Set to application/json
Webhook configuration details

​
Configure webhook in GitHub

  1. Go to your repository settings
  2. Navigate to Webhooks > Add webhook
  3. Enter the Payload URL from Ona
  4. Set Content type to application/json
  5. Enter the Secret from Ona
  6. Select Let me select individual events
  7. Check Pull requests
  8. Click Add webhook
GitHub documentation: Creating webhooks

​
Configure webhook in GitLab

  1. Go to your repository settings
  2. Navigate to Webhooks
  3. Enter the URL from Ona
  4. Enter the Secret token from Ona
  5. Under Trigger, check Merge request events
  6. Click Add webhook
GitLab documentation: Webhooks Note: Bitbucket is not currently supported.

​
Authentication & security

Webhooks use the secret token to authenticate requests:
  • GitHub and GitLab sign webhook payloads with the secret
  • Ona verifies the signature before processing events
  • Invalid signatures are rejected
Keep your webhook secret secure. Regenerate it if compromised.

​
Use cases

​
Automated security scanning

Scan for vulnerabilities when code changes: Configuration:
  • Events: Opened, Updated
  • Target: All repositories in “org:ona”
  • Steps: Run security scanner, comment findings on PR
Result: Security issues detected before code review.

​
Documentation validation

Ensure documentation stays current with code changes: Configuration:
  • Events: Ready for review
  • Target: Repositories with “public-api” tag
  • Steps: Check API changes, update docs, commit changes
Result: Documentation automatically updated when APIs change.

​
Next steps