BlameTrail
Code Analysis

Automatic Analysis

Register a GitHub push webhook so BlameTrail automatically analyzes every commit as it is pushed, without CI/CD changes.

Automatic analysis lets BlameTrail inspect code changes the moment they are pushed to GitHub, without requiring any modifications to your CI/CD pipeline. By registering a GitHub push webhook, every push event is verified, commits are ingested, and -- if auto-analyze is enabled -- a commit analysis runs automatically.

Setting up the webhook

Step 1: Generate the webhook secret

  1. Navigate to the repository settings page within BlameTrail (accessible from the service detail page or Organization > Integrations).
  2. Click Register Push Webhook.
  3. BlameTrail generates an HMAC secret. Copy this value -- it is displayed only once.

Step 2: Add the webhook in GitHub

  1. Open your repository on GitHub.
  2. Go to Settings > Webhooks > Add webhook.
  3. Configure the webhook:
FieldValue
Payload URLhttps://<your-blametrail-domain>/api/github/webhook
Content typeapplication/json
SecretPaste the HMAC secret from Step 1
EventsSelect Just the push event
  1. Click Add webhook.

Step 3: Verify the connection

Push a commit to the repository. BlameTrail verifies the HMAC signature on every incoming webhook payload. If verification succeeds, the push appears in your deploy timeline within seconds.

You can confirm the webhook is active by checking the Recent Deliveries tab on the GitHub webhook settings page. A 200 response indicates success.

Enabling auto-analyze

Registering the webhook alone only ingests commits. To trigger automatic commit analysis on every push:

  1. Open the repository settings page in BlameTrail.
  2. Toggle Auto-Analyze to on.
  3. Click Save.

With auto-analyze enabled, every push event triggers a commit analysis for each new commit. Results appear on the Analyses page as they complete.

How verification works

BlameTrail uses HMAC-SHA256 to verify webhook payloads:

  1. GitHub signs each payload using the shared secret and includes the signature in the X-Hub-Signature-256 header.
  2. BlameTrail recomputes the signature using the stored secret and compares it to the header value.
  3. If the signatures do not match, the request is rejected with a 401 response. Rejected payloads are logged for audit purposes.

This ensures that only legitimate push events from GitHub are processed.

Managing the webhook

From the repository settings page in BlameTrail, you can:

  • Rotate the secret -- Generates a new HMAC secret and invalidates the previous one. You must update the secret in GitHub after rotating.
  • Disable auto-analyze -- Stops automatic analysis while still ingesting commits from push events.
  • Remove the webhook -- Deletes the webhook registration from BlameTrail. You should also remove the webhook from GitHub to stop sending payloads.

Analysis credits

Automatic analyses consume the same monthly credits as manual analyses. Monitor your usage on the Settings > Billing page. If you exceed your plan's limit, auto-analyze pauses until the next billing cycle.

See Plans and Pricing for credit limits by plan.

Next steps

Range Analysis

Analyze an entire range of commits between two SHAs to get a comprehensive view of what changed across multiple deploys.

Organizations

Understand organizations in BlameTrail -- the top-level container for services, monitors, incidents, integrations, and team members.

On this page

Setting up the webhookStep 1: Generate the webhook secretStep 2: Add the webhook in GitHubStep 3: Verify the connectionEnabling auto-analyzeHow verification worksManaging the webhookAnalysis creditsNext steps