Apps and audit automations

Veriom connects the review loop: choose a repository and branch, decide when to audit, and send the outcome to the people who need it. Open Continuous audits to manage Schedules, GitHub events, Apps, and Activity.

Connect a messaging app

In Apps, choose Slack, Discord, or Webhook. Workspace Owners and Admins can manage team destinations. Every member can manage their own email updates in Settings → Notifications.

See the official Slack incoming webhook guide and Discord webhook guide to create a channel destination. This connection uses an incoming webhook; channel membership and permissions stay in the messaging service.

Give the app a recognizable name, such as Engineering audit updates. Select its events: audit completed, audit failed, automation needs attention, report ready, approval needed, queued audit, remediation pull request, or overdue finding.

You can restrict updates to a repository, a listed branch, and an audit trigger: any, scheduled, GitHub event, or manual. A branch filter requires a repository. Leaving both empty includes repository and uploaded-source audits. Filters match the audit's recorded branch and trigger, including report events associated with that audit.

An audit completed event includes both successful audits and partial results. Messages explicitly identify coverage gaps; they do not present incomplete evidence as a fully successful review. Automation needs attention covers a run that could not start because of repository access, an unavailable branch, or another admission problem.

After saving, use Send test. The test queues a clearly labelled message for the selected destination without starting an audit. It is delivered only after the service confirms receipt. Check Delivery history for the result.

Schedule a branch review

1. Open Schedules and name the review.
2. Select a repository, then choose a branch from its searchable list. Follow default branch follows the repository's default at each run. A named branch stays selected even if the repository's default changes.
3. Choose daily, weekly, every two weeks, or monthly, then set the local time and day.
4. Search the timezone list by region or city. The displayed offset is today's offset; the run preview uses the offset at each occurrence.
5. Preview the next five runs. Each shows the selected local timezone and its corresponding UTC instant.
6. Save the schedule, then open Apps to configure matching notifications.

Every run captures the latest available commit on the selected branch when admitted. Veriom retains that commit with the audit. A removed or inaccessible branch does not silently fall back to another branch.

Schedules keep wall-clock time through daylight-saving changes. A nonexistent local time moves to the first valid minute; a repeated local time uses the first occurrence. Monthly schedules on the 29th–31st use the last available day in shorter months. Every-two-weeks schedules retain their anchor date when edited.

Run once when service returns coalesces missed occurrences into one run and advances to the next future occurrence. Skip the missed run uses the scheduler's catch-up policy. Pause a saved schedule to retain its settings and history, or edit its branch, cadence, local time, and timezone. Disabled schedules remain in the audit trail.

React to GitHub changes

Use GitHub events for pushes, pull requests, or merged pull requests. Add branches from the repository list, and use patterns such as release/** for branches created later. Leave the branch filter empty to match all branches. Optional path patterns and a minimum changed-file count reduce unnecessary runs.

Direct pushes to protected branches require approval. The conflict policy controls whether a competing audit waits, is ignored, or requires a replacement decision. Activity records why a trigger ran, waited, failed, or was ignored. Messaging apps can notify the team when an approval or intervention is needed.

Delivery history and recovery

Queued means an event is waiting for a worker. Sending means a request is in progress. Delivered means the service confirmed receipt. Retrying includes the next attempt time. Failed or Canceled can be retried after the app is active and the endpoint has been corrected.

Temporary errors, timeouts, and rate limits retry automatically, up to eight attempts per cycle. Provider retry delays apply to the whole destination. A worker restart recovers an expired delivery lease. Permanent rejections, such as revoked channel access, remain failed until you fix the endpoint and retry. Lifetime attempt counts stay visible after a manual retry.

Pausing prevents new matching events and cancels waiting deliveries when the worker processes them. A request already in flight may finish. Editing the endpoint affects future attempts, including retries. No delivery mechanism can guarantee exactly-once receipt after a network timeout; custom receivers must deduplicate the stable delivery ID.

Verify a generic webhook

Destinations must use public HTTPS on port 443. Redirects, private addresses, embedded usernames, and fragments are rejected. Endpoint paths and query tokens are encrypted and hidden after saving. Slack and Discord URLs must match the provider's incoming webhook format.

Veriom signs the exact JSON request body. Save the signing secret shown once when you create a generic webhook. The request includes:

Compute HMAC-SHA256 with the signing secret over timestamp + "." + delivery_id + "." + raw_request_body. Compare signatures in constant time, reject timestamps outside your allowed clock tolerance, and deduplicate the delivery ID before doing work. Return a successful HTTP response only after accepting the event durably.

The JSON envelope retains id, event, workspace_id, resource_type, resource_id, created_at, and data, and includes a context object with the audit summary and scope. Events derived from a durable workspace event also include event_id. Credentials and operator accounting details are excluded.

Rotate signing secret invalidates the previous secret for future attempts. Update your receiver immediately. Slack and Discord authenticate through their endpoint token and do not require you to validate Veriom's signature.

Try the interactive demo

Open Apps & automations in the demo to select a branch and timezone, choose a destination, pause the sample automation, and preview successful, partial, and failed outcomes. The demo uses fictional data and sends no messages.