5-minute recipe

Dependabot PRs, on your phone

When Dependabot opens a pull request, Zenhook sends you the title, repository, and a button that opens the PR. No GitHub App and no repository write access.

Trigger

New Dependabot PR

Destination

One Zenhook channel

Action

Tap “View PR”

1. Create a channel

Create a channel named dependabot, then copy its complete webhook URL from channel settings.

2. Test the channel

Replace the placeholder and run this once. The sample alert should arrive on your phone immediately.

bash

curl -X POST "YOUR_ZENHOOK_WEBHOOK_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Bump lodash from 4.17.20 to 4.17.21",
    "level": "info",
    "emoji": "package",
    "source": "Dependabot",
    "message": "Dependency update proposed in acme/api",
    "linkUrl": "https://github.com/acme/api/pull/42",
    "linkText": "View PR"
  }'

3. Add one Dependabot secret

In GitHub, open Settings → Secrets and variables → Dependabot. Create a repository secret named ZENHOOK_WEBHOOK_URL and paste the complete channel webhook URL.

Use a Dependabot secret, not a regular Actions secret. GitHub only exposes Dependabot secrets to workflows initiated by Dependabot.

4. Copy the workflow

Save this as .github/workflows/zenhook-dependabot.yml on your default branch.

yaml

name: Zenhook - Dependabot alerts

on:
  pull_request:
    types: [opened, reopened]

permissions:
  contents: read

jobs:
  notify:
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - name: Send the pull request to Zenhook
        env:
          ZENHOOK_WEBHOOK_URL: ${{ secrets.ZENHOOK_WEBHOOK_URL }}
          PR_TITLE: ${{ github.event.pull_request.title }}
          PR_URL: ${{ github.event.pull_request.html_url }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPOSITORY: ${{ github.repository }}
        run: |
          jq -n \
            --arg title "$PR_TITLE" \
            --arg url "$PR_URL" \
            --arg number "$PR_NUMBER" \
            --arg repository "$REPOSITORY" \
            '{
              title: $title,
              level: "info",
              emoji: "package",
              source: "Dependabot",
              message: ("Dependency update proposed in " + $repository),
              fields: [
                { label: "Repository", value: $repository },
                { label: "Pull request", value: ("#" + $number) }
              ],
              linkUrl: $url,
              linkText: "View PR"
            }' | curl --fail-with-body --retry 2 \
              -X POST "$ZENHOOK_WEBHOOK_URL" \
              -H "Content-Type: application/json" \
              --data-binary @-

The workflow does not check out or execute pull-request code. Its GitHub token is read-only; it only sends the PR metadata already present in the event to your private Zenhook URL.

One repository or several?

One: add the secret and workflow to that repository.
Several: create an organization-level Dependabot secret, grant it only to the selected repositories, and add the same workflow file to each.

This recipe sends an alert and a link. It does not approve or merge the PR. See GitHub’s documentation onDependabot workflowsandDependabot secrets.