diff --git a/.github/workflows/daily-cli-tests.yml b/.github/workflows/daily-cli-tests.yml index 60a7b3f56..754c6dabe 100644 --- a/.github/workflows/daily-cli-tests.yml +++ b/.github/workflows/daily-cli-tests.yml @@ -47,8 +47,6 @@ jobs: azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} bitbucket_access_token: ${{ secrets.KOSLI_BITBUCKET_ACCESS_TOKEN }} jira_api_token: ${{ secrets.KOSLI_JIRA_API_TOKEN }} - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures snyk_token: ${{ secrets.SNYK_TOKEN }} kosli_reporting_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} kosli_querying_api_token: ${{ secrets.KOSLI_API_TOKEN_PROD }} @@ -107,5 +105,5 @@ jobs: - name: Slack Notification on Failure uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main with: - slack_url: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} + slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 02b330831..cc41c0c16 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -30,10 +30,6 @@ on: type: string default: 'none' secrets: - slack_channel: - required: true - slack_webhook: - required: true kosli_api_token: required: true snyk_token: diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e7b0121e6..624581a0b 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -108,8 +108,6 @@ jobs: azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} bitbucket_access_token: ${{ secrets.KOSLI_BITBUCKET_ACCESS_TOKEN }} jira_api_token: ${{ secrets.KOSLI_JIRA_API_TOKEN }} - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures snyk_token: ${{ secrets.SNYK_TOKEN }} kosli_reporting_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} kosli_querying_api_token: ${{ secrets.KOSLI_API_TOKEN_PROD }} @@ -127,8 +125,6 @@ jobs: checkout_ref: ${{ needs.pre-build.outputs.checkout_ref }} report_to_kosli: ${{ needs.pre-build.outputs.report_to_kosli }} secrets: - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} snyk_token: ${{ secrets.SNYK_TOKEN }} @@ -154,5 +150,5 @@ jobs: - name: Slack Notification on Failure uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main with: - slack_url: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} + slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 908a43f6b..f00f174c8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -105,8 +105,6 @@ jobs: azure_client_id: ${{ secrets.AZURE_CLIENT_ID }} azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} bitbucket_access_token: ${{ secrets.KOSLI_BITBUCKET_ACCESS_TOKEN }} - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures jira_api_token: ${{ secrets.KOSLI_JIRA_API_TOKEN }} snyk_token: ${{ secrets.SNYK_TOKEN }} kosli_reporting_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} @@ -124,8 +122,6 @@ jobs: kosli_org: kosli-public report_to_kosli: release secrets: - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} snyk_token: ${{ secrets.SNYK_TOKEN }} @@ -309,6 +305,39 @@ jobs: AWS_ACCOUNT_ID: 585008075785 AWS_REGION: eu-central-1 + slack-notification-on-failure: + runs-on: ubuntu-24.04 + permissions: + actions: read + contents: read + needs: + [ + notify-start, + pre-build, + init-kosli, + never-alone-trail, + test, + docker, + goreleaser, + binary-provenance, + docs-repo-dispatch, + evidence-reporter-upload-package-and-deploy, + environment-reporter-upload-package-and-deploy, + environment-reporter-upload-layer + ] + if: ${{ always() && (contains(join(needs.*.result, ','), 'failure') || contains(join(needs.*.result, ','), 'cancelled')) }} + steps: + - name: Harden Runner + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + with: + egress-policy: audit + + - name: Slack Notification on Failure + uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main + with: + slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} + github_token: ${{ secrets.GITHUB_TOKEN }} + notify-finish: needs: [ diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f5bcd09d6..975124f07 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -39,10 +39,6 @@ on: type: string default: '' secrets: - slack_channel: - required: true - slack_webhook: - required: true github_access_token: required: true gitlab_access_token: