From 0ff852d2cec48dadd1f0b689b1984f39af739ae5 Mon Sep 17 00:00:00 2001
From: Alexandre Tavares <alexandre.tavares@parfin.io>
Date: Mon, 18 May 2026 16:47:35 +0100
Subject: [PATCH] fix(ci): use slack incoming webhook for trufflehog alerts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous PR (#15) wired SLACK_BOT_TOKEN into the workflow, but
that token is an org-level secret with a `selected` allowlist that
currently only covers 8 private repos. Adding `rayls-explorer-frontend`
(public) to the allowlist would make it the first public repo with
access to a workspace-wide bot token — wider blast radius than needed
for this use case.

Switch to a Slack Incoming Webhook instead:
- a webhook URL is scoped to a single channel and can only post (no
  read, no DMs, no other API methods), so a leak is contained
- store it as a repo-level secret (SLACK_WEBHOOK_URL) — no org-wide
  allowlist change needed

Required follow-up before this works:
1. create an Incoming Webhook in Slack pointing at the alerts channel
2. set it as a repo secret with `gh secret set SLACK_WEBHOOK_URL`
---
 .github/workflows/_security-history-scan.yml | 11 +++++++----
 .github/workflows/security-history-scan.yml  |  2 +-
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/_security-history-scan.yml b/.github/workflows/_security-history-scan.yml
index be2c9a6c734..cac7c998a54 100644
--- a/.github/workflows/_security-history-scan.yml
+++ b/.github/workflows/_security-history-scan.yml
@@ -52,7 +52,7 @@ on:
         required: false
         type: string
     secrets:
-      SLACK_BOT_TOKEN:
+      SLACK_WEBHOOK_URL:
         required: false
 
 permissions:
@@ -179,17 +179,20 @@ jobs:
       # Notify Slack on findings
       # Issues are disabled on this repo (it's a fork of Blockscout), so Slack
       # is the active alert channel. The job summary still shows the table.
+      #
+      # Uses an Incoming Webhook URL (channel is bound to the webhook itself)
+      # instead of a workspace-wide bot token, to minimize blast radius on
+      # this public repository — a leaked webhook can only post to one channel.
       # -----------------------------------------------------------------------
       - name: Notify Slack on findings
         if: steps.scan.outputs.findings_count != '0'
         continue-on-error: true
         uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
         with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
           payload: |
             {
-              "channel": "C0AASHLNKQE",
               "text": ":rotating_light: *TruffleHog detected ${{ steps.scan.outputs.findings_count }} secret(s)* in `${{ github.repository }}`",
               "blocks": [
                 {
diff --git a/.github/workflows/security-history-scan.yml b/.github/workflows/security-history-scan.yml
index e3f7681ef37..fcf0b0a9bb4 100644
--- a/.github/workflows/security-history-scan.yml
+++ b/.github/workflows/security-history-scan.yml
@@ -41,4 +41,4 @@ jobs:
     permissions:
       contents: read
     secrets:
-      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}