wehub-resource-sync
88 lines
2.8 KiB
YAML
88 lines
2.8 KiB
YAML
name: Dependabot Critical Alerts
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 8 * * *" # Daily 08:00 UTC
|
|
workflow_dispatch:
|
|
inputs:
|
|
severity:
|
|
description: "Severity to alert on"
|
|
type: choice
|
|
options:
|
|
- critical
|
|
- high
|
|
- medium
|
|
- low
|
|
default: critical
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
alert:
|
|
name: Post critical alerts
|
|
# Set the ENABLE_DEPENDABOT_ALERTS repository variable to 'false' to turn off
|
|
# the Dependabot alert/summary notifiers — e.g. forks/mirrors that lack the
|
|
# DEPENDABOT_ALERTS_TOKEN / SLACK_BOT_TOKEN secrets. Defaults to enabled.
|
|
if: ${{ vars.ENABLE_DEPENDABOT_ALERTS != 'false' }}
|
|
runs-on: warp-ubuntu-latest-x64-2x
|
|
environment: dependabot-summary
|
|
env:
|
|
SEVERITY: ${{ inputs.severity || 'critical' }}
|
|
steps:
|
|
- name: Fetch alerts
|
|
id: alerts
|
|
env:
|
|
GH_TOKEN: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }}
|
|
REPO: ${{ github.repository }}
|
|
run: |
|
|
set -euo pipefail
|
|
gh api -X GET "/repos/$REPO/dependabot/alerts" \
|
|
-F state=open -F severity="$SEVERITY" --paginate > pages.json
|
|
jq -s 'add' pages.json > alerts.json
|
|
TOTAL=$(jq 'length' alerts.json)
|
|
echo "total=$TOTAL" >> "$GITHUB_OUTPUT"
|
|
if [ "$TOTAL" = "0" ]; then
|
|
exit 0
|
|
fi
|
|
LIST=$(jq -r '
|
|
map("• <\(.html_url)|#\(.number)> *\(.dependency.package.name)* - \(.security_advisory.summary)")
|
|
| join("\n")
|
|
' alerts.json)
|
|
{
|
|
echo "list<<EOF"
|
|
echo "$LIST"
|
|
echo "EOF"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build Slack payload
|
|
if: steps.alerts.outputs.total != '0'
|
|
env:
|
|
REPO: ${{ github.repository }}
|
|
CHANNEL: ${{ vars.SLACK_CHANNEL_ID }}
|
|
TOTAL: ${{ steps.alerts.outputs.total }}
|
|
LIST: ${{ steps.alerts.outputs.list }}
|
|
run: |
|
|
jq -n \
|
|
--arg channel "$CHANNEL" \
|
|
--arg repo "$REPO" \
|
|
--arg total "$TOTAL" \
|
|
--arg list "$LIST" \
|
|
--arg severity "$SEVERITY" \
|
|
'{
|
|
channel: $channel,
|
|
text: ":bufo-alarma: `\($repo)` - *\($total) open \($severity) alert(s)*\n\($list)\n\n<https://github.com/\($repo)/security/dependabot?q=is%3Aopen+severity%3A\($severity)|View \($severity) alerts>"
|
|
}' > payload.json
|
|
|
|
- name: Post Slack alert
|
|
if: steps.alerts.outputs.total != '0'
|
|
uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
|
|
with:
|
|
method: chat.postMessage
|
|
token: ${{ secrets.SLACK_BOT_TOKEN }}
|
|
payload-file-path: payload.json
|