Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/pr-labels.yml
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,6 @@ permissions:

jobs:
labels:
runs-on: ubuntu-latest
runs-on: namespace-profile-btp-docs
steps:
- uses: fuxingloh/multi-labeler@v4
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 suggestion (security): Consider pinning this action to a specific commit hash for security, like the other actions in pr-settings.yml

Suggested implementation:

      - uses: fuxingloh/multi-labeler@c97de6e4c5d8066a2fa0f1e9b0a3d30c0b9e1d8c

The exact commit hash I provided (c97de6e4c5d8066a2fa0f1e9b0a3d30c0b9e1d8c) should be verified against the latest stable commit in the fuxingloh/multi-labeler repository's v4 branch to ensure you're using the most recent secure version.

25 changes: 18 additions & 7 deletions .github/workflows/pr-settings.yml
Original file line number Diff line number Diff line change
Expand Up @@ -23,24 +23,35 @@ permissions:

jobs:
labels:
runs-on: ubuntu-latest
runs-on: namespace-profile-btp-docs
steps:
- name: Configure 1Password
uses: 1password/load-secrets-action/configure@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2
with:
service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

- name: Load secrets
uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2
env:
PR_SLACK_WEBHOOK_URL: op://platform/slack-webhooks/pr-webhook

- name: Send GitHub Action trigger data to Slack workflow with reviewers
if: ${{ tojson(github.event.pull_request.requested_reviewers) != '[]' && !github.event.pull_request.draft }}
uses: slackapi/slack-github-action@v2.0.0
env:
SLACK_WEBHOOK_URL: ${{ secrets.PR_SLACK_WEBHOOK_URL }}
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
with:
webhook: ${{ env.PR_SLACK_WEBHOOK_URL }}
webhook-type: webhook-trigger
payload: |
{
"message": "${{ github.event.pull_request.title }} (by ${{ github.event.pull_request.user.login }} and to be checked by ${{ join(github.event.pull_request.requested_reviewers.*.login, ', ') }}) -> ${{ github.event.pull_request.html_url }}"
}

- name: Send GitHub Action trigger data to Slack workflow without reviewers
if: ${{ !github.event.pull_request.draft }}
uses: slackapi/slack-github-action@v2.0.0
env:
SLACK_WEBHOOK_URL: ${{ secrets.PR_SLACK_WEBHOOK_URL }}
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
with:
webhook: ${{ env.PR_SLACK_WEBHOOK_URL }}
webhook-type: webhook-trigger
payload: |
{
"message": "${{ github.event.pull_request.title }} (by ${{ github.event.pull_request.user.login }}) -> ${{ github.event.pull_request.html_url }}"
Expand Down