diff --git a/.github/workflows/issue_webhook.yml b/.github/workflows/issue_webhook.yml deleted file mode 100644 index cdf69ef..0000000 --- a/.github/workflows/issue_webhook.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Issues Webhook - -on: - issues: - types: [opened, reopened] - -jobs: - webhook: - runs-on: ubuntu-latest - if: github.event.repository.fork == false - - steps: - - name: Harden runner - uses: portswigger-tim/safer-runner-action@b2208f653b6bf422e08501155f4df82bad008184 # v1.2.2 - with: - mode: enforce - allowed-domains: 'inbots.zoom.us,integrations.zoom.us' - disable-sudo: 'true' - disable-docker: 'true' - block-risky-github-subdomains: 'true' - - - name: Sanitize inputs - id: sanitize - uses: PortSwigger/shared-workflows/sanitize-inputs@ff879d3c7b4476af5ed83d7d81438c7258217644 # v1.0.0 - with: - type: bcheck - title: ${{ github.event.issue.title }} - author: ${{ github.event.issue.user.login }} - url: ${{ github.event.issue.html_url }} - - - name: Post to webhook - if: steps.sanitize.outputs.error_message == '' - uses: fjogeleit/http-request-action@551353b829c3646756b2ec2b3694f819d7957495 # v2.0.0 - with: - url: ${{ secrets.WEBHOOK_URL }} - method: POST - contentType: text/plain - customHeaders: '{"Authorization": "${{ secrets.AUTH_TOKEN }}"}' - data: | - ${{ steps.sanitize.outputs.author }} - ${{ steps.sanitize.outputs.title }} - ${{ steps.sanitize.outputs.url }} diff --git a/.github/workflows/pr_webhook.yml b/.github/workflows/pr_webhook.yml deleted file mode 100644 index e991988..0000000 --- a/.github/workflows/pr_webhook.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Pull Request Webhook - -on: - pull_request_target: - types: [opened, reopened] - -jobs: - webhook: - runs-on: ubuntu-latest - if: github.event.repository.fork == false - - steps: - - name: Harden runner - uses: portswigger-tim/safer-runner-action@b2208f653b6bf422e08501155f4df82bad008184 # v1.2.2 - with: - mode: enforce - allowed-domains: 'inbots.zoom.us,integrations.zoom.us' - disable-sudo: 'true' - disable-docker: 'true' - block-risky-github-subdomains: 'true' - - - name: Sanitize inputs - id: sanitize - uses: PortSwigger/shared-workflows/sanitize-inputs@ff879d3c7b4476af5ed83d7d81438c7258217644 # v1.0.0 - with: - type: bcheck - title: ${{ github.event.pull_request.title }} - author: ${{ github.event.pull_request.user.login }} - url: ${{ github.event.pull_request.html_url }} - - - name: Post to webhook - if: steps.sanitize.outputs.error_message == '' - uses: fjogeleit/http-request-action@551353b829c3646756b2ec2b3694f819d7957495 # v2.0.0 - with: - url: ${{ secrets.WEBHOOK_URL }} - method: POST - contentType: text/plain - customHeaders: '{"Authorization": "${{ secrets.AUTH_TOKEN }}"}' - data: | - ${{ steps.sanitize.outputs.author }} - ${{ steps.sanitize.outputs.title }} - ${{ steps.sanitize.outputs.url }} diff --git a/.github/workflows/webhook.yml b/.github/workflows/webhook.yml new file mode 100644 index 0000000..1b2ab61 --- /dev/null +++ b/.github/workflows/webhook.yml @@ -0,0 +1,74 @@ +name: Submission Webhook + +on: + pull_request_target: + types: [opened, reopened] + issues: + types: [opened, reopened] + +jobs: + webhook: + runs-on: ubuntu-latest + if: github.event.repository.fork == false + env: + KIND: ${{ github.event_name == 'issues' && 'issue' || 'PR' }} + EMOJI: ${{ github.event_name == 'issues' && ':speech_balloon:' || ':inbox_tray:' }} + + steps: + - name: Harden runner + uses: portswigger-tim/safer-runner-action@b2208f653b6bf422e08501155f4df82bad008184 # v1.2.2 + with: + mode: enforce + allowed-domains: 'hooks.slack.com' + disable-sudo: 'true' + disable-docker: 'true' + block-risky-github-subdomains: 'true' + + - name: Sanitize inputs + id: sanitize + uses: PortSwigger/shared-workflows/sanitize-inputs@ff879d3c7b4476af5ed83d7d81438c7258217644 # v1.0.0 + with: + type: bcheck + title: ${{ github.event.pull_request.title || github.event.issue.title }} + author: ${{ github.event.pull_request.user.login || github.event.issue.user.login }} + url: ${{ github.event.pull_request.html_url || github.event.issue.html_url }} + + - name: Post to webhook + if: steps.sanitize.outputs.error_message == '' + uses: fjogeleit/http-request-action@551353b829c3646756b2ec2b3694f819d7957495 # v2.0.0 + with: + url: ${{ secrets.WEBHOOK_URL }} + method: POST + contentType: application/json + data: | + { + "text": "New BCheck ${{ env.KIND }} from ${{ steps.sanitize.outputs.author }}", + "blocks": [ + { + "type": "header", + "text": { "type": "plain_text", "text": "${{ env.EMOJI }} New BCheck ${{ env.KIND }}", "emoji": true } + }, + { + "type": "section", + "text": { "type": "mrkdwn", "text": "*<${{ steps.sanitize.outputs.url }}|${{ steps.sanitize.outputs.title }}>*" } + }, + { + "type": "context", + "elements": [ + { "type": "image", "image_url": "https://github.com/${{ steps.sanitize.outputs.author }}.png", "alt_text": "avatar" }, + { "type": "mrkdwn", "text": "Opened by *${{ steps.sanitize.outputs.author }}*" } + ] + }, + { + "type": "actions", + "elements": [ + { + "type": "button", + "text": { "type": "plain_text", "text": "Review ${{ env.KIND }}", "emoji": true }, + "style": "primary", + "url": "${{ steps.sanitize.outputs.url }}" + } + ] + } + ] + }