Correlate an alert with recent GitHub changes using Gemini and page Slack

When an alert fires, the first question on call is "what changed?". Answering it means jumping between GitHub commit lists, merged pull requests and chat, usually while the incident is already running.

This blueprint answers it automatically:

• Takes an alert (service, severity, summary and the affected repository) from a webhook or from the UI.
• Fetches recent commits and merged pull requests for the repository in parallel.
• Asks Google Gemini to shortlist at most three likely culprits with a one-line reason each, and to say "No likely culprit" instead of inventing one.
• Posts the alert and the shortlist to Slack.
• Opens a GitHub incident issue when the severity is critical.

How it works

1. alert_webhook (io.kestra.plugin.core.trigger.Webhook) receives the alert; service, severity, summary and repository from the JSON body map onto the flow inputs, so the flow also runs from the UI Execute button.
2. gather_changes (io.kestra.plugin.core.flow.Parallel) runs recent_commits (io.kestra.plugin.github.commits.Search) and merged_prs (io.kestra.plugin.github.pulls.Search) at the same time, limited to the last lookback_hours.
3. rank_suspects (io.kestra.plugin.ai.completion.ChatCompletion, Google Gemini) receives the alert, the commits and the merged PRs and returns the ranked shortlist.
4. page_slack (io.kestra.plugin.slack.notifications.SlackIncomingWebhook) posts the alert, the change counts and the suspects.
5. escalate_if_critical (io.kestra.plugin.core.flow.If) runs only when severity is critical: open_incident_issue (io.kestra.plugin.github.issues.Create) opens a GitHub issue labelled incident with the shortlist in the body.

What you get

• A starting point in seconds: the changes that shipped just before the alert, ranked, in the channel where on-call already is.
• Grounded output: the model only sees real commits and PRs from the repository and is told never to invent changes.
• Escalation on severity: critical alerts leave a tracked GitHub issue; lower severities only notify Slack.
• One flow, two entry points: the webhook for monitoring tools and the UI form for manual runs.

Who it's for

• On-call engineers and SREs who lose time correlating alerts with recent deployments.
• Platform teams that want a first-pass triage step in front of their incident process.
• Teams that already use GitHub and Slack and want AI assistance without a separate tool.

Why orchestrate this with Kestra

The pieces exist separately: monitoring fires a webhook, GitHub has the history, a model can summarise it. Kestra connects them with a webhook trigger, runs the two GitHub searches in parallel, branches on severity, and keeps a record of every alert, every prompt input and every suggestion, which is useful in a post-incident review.

Prerequisites

• A GitHub token that can search commits and pull requests and create issues on the repository.
• A Google Gemini API key.
• A Slack incoming webhook.
• Replace the placeholder webhook key in the trigger with a long random string before enabling it.

Secrets

• GITHUB_TOKEN: GitHub token used for the commit and PR searches and for creating the incident issue.
• GEMINI_API_KEY: Google Gemini API key used by rank_suspects (model gemini-3.5-flash-lite).
• SLACK_WEBHOOK: Slack incoming webhook URL used by page_slack.

Inputs

• service (STRING, default checkout): service named in the alert.
• severity (STRING, default critical): critical also opens a GitHub incident issue.
• summary (STRING, default 5xx > 5%): one-line alert description.
• repository (STRING, default acme/checkout): owner/repo whose recent changes are searched.
• lookback_hours (INT, default 6): how far back to look for commits and merged PRs.

Quick start

1. Add GITHUB_TOKEN, GEMINI_API_KEY and SLACK_WEBHOOK to your Kestra namespace secrets.
2. Set the repository default (or pass it per alert) and replace the webhook key.
3. Execute the flow from the UI to test, or call the webhook:

   curl -X POST "https://kestra.example.com/api/v1/main/executions/webhook/company.sre/alert-change-correlator/<webhook-key>" \
     -H "Content-Type: application/json" \
     -d '{"service":"checkout","severity":"critical","summary":"5xx > 5%","repository":"acme/checkout"}'
   

4. Check Slack for the shortlist and, for critical alerts, the new GitHub issue.

How to extend

• More context for the model: add a Parallel branch that fetches deployment events or feature flag changes.
• Different model: swap the provider for another Kestra AI provider without touching the rest of the flow.
• Paging: replace or add page_slack with a PagerDuty or Opsgenie task for critical alerts.
• Several repositories: wrap the flow in a Subflow and call it once per service-to-repository mapping.

Links

• GitHub plugin
• AI plugin
• Slack plugin
• Webhook trigger
• Parallel task