Merge GitHub Pull Requests with Authy OneTouch

Adding a security layer to merge pull requests is easy to implement using cloud platforms like Authy. In just a few hours I was able to set up the entire process, and thought that perhaps I could help you shave some time off your workload by showing you how.

As you know, GitHub has a well-documented API, and I used their webhooks to trigger pull requests events. The pull requests are received by an external app built to create Authy OneTouch transactions, and after a user approves these transactions this app uses the GitHub API to merge the pull requests. The workflow is better explained in the next image.

Below is a demo app merging a pull request with Authy OneTouch:

You can find the demo app at https://github.com/cepinos/merge-pull-requests-with-authy-onetouch. Feel free to clone or fork this.

To create the webhook in Authy, go to Settings, and add the url for the OneTouch approves. This will call the app to approve or deny the merge:

How to create the Webhooks:

The path to create the webhooks in GitHub is at YOURREPO > settings > Webhooks & Services. Add a new webhook and configure it to trigger pull requests events:

The webhook that receives the pull requests created saves the JSON object sent by GitHub. This controller is also in charge of creating the OneTouch transaction:

After a transaction is approved, Authy triggers a webhook to merge the pull request.

By adding multiple approves from admins before merge a pull request, this app can be used to add a security layer in your repositories. Please let me know how this process works for you and/or if you have any questions. I can be reached at [email protected].