mirror of
https://github.com/th30d4y/OpenLearnX.git
synced 2026-05-26 19:26:33 +00:00
Replace SMTP email with Discord webhook for advisory notifications
Agent-Logs-Url: https://github.com/th30d4y/OpenLearnX/sessions/c1dfb007-d13e-4526-b2aa-1abb3365dd5a Co-authored-by: 0x5t4l1n <161853795+0x5t4l1n@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
committed by
GitHub
GitHub
parent
a642d16f89
commit
6213bc68f7
@@ -0,0 +1,102 @@
|
||||
name: Security Advisory Discord Notification
|
||||
|
||||
on:
|
||||
repository_advisory:
|
||||
types: [reported, created, published, submitted, reopened]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
notify-owners:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Ensure Discord webhook is configured
|
||||
id: check_secret
|
||||
env:
|
||||
DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
|
||||
run: |
|
||||
if [ -z "$DISCORD_WEBHOOK" ]; then
|
||||
echo "::warning::Missing required secret: DISCORD_WEBHOOK. Skipping advisory notification. Add a Discord webhook URL as the DISCORD_WEBHOOK secret in your repository or organization settings."
|
||||
echo "skip=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "skip=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Send Discord notification
|
||||
if: steps.check_secret.outputs.skip == 'false'
|
||||
env:
|
||||
DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
|
||||
ADVISORY_TITLE: ${{ github.event.repository_advisory.summary }}
|
||||
ADVISORY_SEVERITY: ${{ github.event.repository_advisory.severity }}
|
||||
ADVISORY_STATE: ${{ github.event.repository_advisory.state }}
|
||||
ADVISORY_CVE: ${{ github.event.repository_advisory.cve_id }}
|
||||
ADVISORY_URL: ${{ github.event.repository_advisory.html_url }}
|
||||
ADVISORY_DESCRIPTION: ${{ github.event.repository_advisory.description }}
|
||||
ADVISORY_ACTION: ${{ github.event.action }}
|
||||
REPO: ${{ github.repository }}
|
||||
ACTOR: ${{ github.actor }}
|
||||
run: |
|
||||
# Map severity to a Discord embed colour (decimal RGB)
|
||||
case "${ADVISORY_SEVERITY,,}" in
|
||||
critical) COLOR=9831467 ;; # #960B0B dark red
|
||||
high) COLOR=15548997 ;; # #ED4245 red
|
||||
medium) COLOR=15105570 ;; # #E67E22 orange
|
||||
low) COLOR=16776960 ;; # #FFFF00 yellow
|
||||
*) COLOR=8421504 ;; # #808080 grey
|
||||
esac
|
||||
|
||||
# Build optional CVE field entry
|
||||
CVE_FIELD=""
|
||||
if [ -n "$ADVISORY_CVE" ]; then
|
||||
CVE_FIELD=$(jq -n --arg cve "$ADVISORY_CVE" \
|
||||
'{name: "CVE ID", value: $cve, inline: true}')
|
||||
CVE_FIELD=",${CVE_FIELD}"
|
||||
fi
|
||||
|
||||
# Truncate description to Discord's 1024-char field limit
|
||||
DESCRIPTION="${ADVISORY_DESCRIPTION:0:1024}"
|
||||
|
||||
PAYLOAD=$(jq -n \
|
||||
--arg title "🔒 Security Advisory ${ADVISORY_ACTION^} in \`${REPO}\`" \
|
||||
--arg footer_text "GitHub Advisory · ${REPO}" \
|
||||
--arg url "$ADVISORY_URL" \
|
||||
--arg adv_title "$ADVISORY_TITLE" \
|
||||
--arg severity "${ADVISORY_SEVERITY^}" \
|
||||
--arg state "${ADVISORY_STATE^}" \
|
||||
--arg actor "$ACTOR" \
|
||||
--arg description "$DESCRIPTION" \
|
||||
--argjson color "$COLOR" \
|
||||
'{
|
||||
embeds: [{
|
||||
title: $title,
|
||||
url: $url,
|
||||
color: $color,
|
||||
fields: [
|
||||
{name: "Title", value: $adv_title, inline: false},
|
||||
{name: "Severity", value: $severity, inline: true},
|
||||
{name: "State", value: $state, inline: true},
|
||||
{name: "Reported by", value: $actor, inline: true},
|
||||
{name: "Description", value: $description, inline: false}
|
||||
],
|
||||
footer: {text: $footer_text}
|
||||
}]
|
||||
}')
|
||||
|
||||
# Inject optional CVE field before the description field
|
||||
if [ -n "$CVE_FIELD" ]; then
|
||||
PAYLOAD=$(echo "$PAYLOAD" | jq \
|
||||
--argjson cve_field "$CVE_FIELD" \
|
||||
'.embeds[0].fields |= .[:3] + [$cve_field] + .[3:]')
|
||||
fi
|
||||
|
||||
RESPONSE=$(curl -sS -o /tmp/discord_response.txt -w "%{http_code}" \
|
||||
-X POST "$DISCORD_WEBHOOK" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "$PAYLOAD")
|
||||
|
||||
if [ "$RESPONSE" -lt 200 ] || [ "$RESPONSE" -ge 300 ]; then
|
||||
echo "::error::Discord webhook failed (HTTP $RESPONSE): $(cat /tmp/discord_response.txt)"
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,93 +0,0 @@
|
||||
name: Security Advisory Email Notification
|
||||
|
||||
on:
|
||||
repository_advisory:
|
||||
types: [reported, created, published, submitted, reopened]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
notify-owners:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Ensure SMTP secrets are configured
|
||||
id: check_secrets
|
||||
env:
|
||||
MAIL_SERVER: ${{ secrets.ADVISORY_MAIL_SERVER }}
|
||||
MAIL_USERNAME: ${{ secrets.ADVISORY_MAIL_USERNAME }}
|
||||
MAIL_PASSWORD: ${{ secrets.ADVISORY_MAIL_PASSWORD }}
|
||||
MAIL_TO: ${{ secrets.ADVISORY_MAIL_TO }}
|
||||
run: |
|
||||
missing=()
|
||||
[ -z "$MAIL_SERVER" ] && missing+=("ADVISORY_MAIL_SERVER")
|
||||
[ -z "$MAIL_USERNAME" ] && missing+=("ADVISORY_MAIL_USERNAME")
|
||||
[ -z "$MAIL_PASSWORD" ] && missing+=("ADVISORY_MAIL_PASSWORD")
|
||||
[ -z "$MAIL_TO" ] && missing+=("ADVISORY_MAIL_TO")
|
||||
|
||||
if [ ${#missing[@]} -gt 0 ]; then
|
||||
echo "::warning::Missing required secrets: ${missing[*]}. Skipping advisory email notification. Configure these secrets in your repository or organization settings."
|
||||
echo "skip=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "skip=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Build email body
|
||||
if: steps.check_secrets.outputs.skip == 'false'
|
||||
id: build_body
|
||||
env:
|
||||
ADVISORY_TITLE: ${{ github.event.repository_advisory.summary }}
|
||||
ADVISORY_SEVERITY: ${{ github.event.repository_advisory.severity }}
|
||||
ADVISORY_STATE: ${{ github.event.repository_advisory.state }}
|
||||
ADVISORY_CVE: ${{ github.event.repository_advisory.cve_id }}
|
||||
ADVISORY_URL: ${{ github.event.repository_advisory.html_url }}
|
||||
ADVISORY_DESCRIPTION: ${{ github.event.repository_advisory.description }}
|
||||
ADVISORY_ACTION: ${{ github.event.action }}
|
||||
REPO: ${{ github.repository }}
|
||||
ACTOR: ${{ github.actor }}
|
||||
run: |
|
||||
CVE_LINE=""
|
||||
if [ -n "$ADVISORY_CVE" ]; then
|
||||
CVE_LINE="CVE ID : $ADVISORY_CVE"$'\n'
|
||||
fi
|
||||
|
||||
BODY="A security advisory has been ${ADVISORY_ACTION} on the repository ${REPO}.
|
||||
|
||||
Repository : https://github.com/${REPO}
|
||||
Action : ${ADVISORY_ACTION}
|
||||
Title : ${ADVISORY_TITLE}
|
||||
Severity : ${ADVISORY_SEVERITY}
|
||||
State : ${ADVISORY_STATE}
|
||||
${CVE_LINE}Advisory : ${ADVISORY_URL}
|
||||
Reported by: ${ACTOR}
|
||||
|
||||
--- Description ---
|
||||
${ADVISORY_DESCRIPTION}
|
||||
|
||||
---
|
||||
This notification was sent automatically by GitHub Actions.
|
||||
Repository: https://github.com/${REPO}
|
||||
"
|
||||
|
||||
# Write to file to avoid multiline env issues
|
||||
printf '%s' "$BODY" > /tmp/advisory_body.txt
|
||||
echo "body_file=/tmp/advisory_body.txt" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Send email to org owners
|
||||
if: steps.check_secrets.outputs.skip == 'false'
|
||||
# dawidd6/action-send-mail v3.12.0 — pinned to exact commit for supply-chain security.
|
||||
# Verify: https://github.com/dawidd6/action-send-mail/commit/2cea9617b09d83a84e7015b8b4c893f01b028020
|
||||
uses: dawidd6/action-send-mail@2cea9617b09d83a84e7015b8b4c893f01b028020
|
||||
with:
|
||||
server_address: ${{ secrets.ADVISORY_MAIL_SERVER }}
|
||||
# ADVISORY_MAIL_PORT defaults to 465 (SMTPS / implicit TLS).
|
||||
# Set the secret to 587 and secure to false if your SMTP server requires STARTTLS instead.
|
||||
server_port: ${{ secrets.ADVISORY_MAIL_PORT || 465 }}
|
||||
secure: ${{ secrets.ADVISORY_MAIL_SECURE || true }}
|
||||
username: ${{ secrets.ADVISORY_MAIL_USERNAME }}
|
||||
password: ${{ secrets.ADVISORY_MAIL_PASSWORD }}
|
||||
subject: "[Security Advisory] [${{ github.event.repository_advisory.severity }}] ${{ github.event.repository_advisory.summary }} — ${{ github.repository }}"
|
||||
to: ${{ secrets.ADVISORY_MAIL_TO }}
|
||||
from: "GitHub Advisory Bot <${{ secrets.ADVISORY_MAIL_USERNAME }}>"
|
||||
body: file:///tmp/advisory_body.txt
|
||||
Reference in New Issue
Block a user