floating_deps_notify #80
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Notify on failure of the `floating_deps` workflow. | |
| # | |
| # Runs in a TRUSTED context: it is triggered by `workflow_run` once | |
| # `floating_deps` completes, and only posts a Slack message. It never checks out | |
| # the repository nor executes any dependency code, so the Slack webhook secret is | |
| # never exposed to the untrusted dependency-resolving job. | |
| name: floating_deps_notify | |
| # This workflow never runs untrusted code nor exposes secrets to it; the workflow_run | |
| # trigger is required to notify from a trusted context after the untrusted build runs. | |
| # It only reads github-controlled metadata. No output produced by the untrusted workflow | |
| # is ever interpreted. | |
| on: # zizmor: ignore[dangerous-triggers] only reads github metadata | |
| workflow_run: | |
| workflows: ["floating_deps"] | |
| types: | |
| - completed | |
| env: | |
| ACTION_RUN_URL: ${{ github.event.workflow_run.html_url }} | |
| SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }} | |
| SLACK_ICON: https://pbs.twimg.com/profile_images/1274014582265298945/OjBKP9kn_400x400.png | |
| SLACK_USERNAME: ${{ secrets.BOT_USERNAME }} | |
| SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} | |
| SLACKIFY_MARKDOWN: true | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.workflow_run.id }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| notify: | |
| name: floating_deps_notify/notify | |
| if: github.event.workflow_run.conclusion == 'failure' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Slack Notification | |
| continue-on-error: true | |
| uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 | |
| env: | |
| SLACK_COLOR: failure | |
| SLACK_MESSAGE: "floating-deps finished with status: ${{ github.event.workflow_run.conclusion }}. | |
| ([action run](${{ env.ACTION_RUN_URL }}))" |