build(deps): bump recharts from 2.15.4 to 3.10.1 in /frontend #519
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Advisory Discord Notification | ||
| on: | ||
| repository_advisory: | ||
| types: [reported, created, published, submitted, reopened] | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| notify-owners: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Ensure Discord webhook is configured | ||
| id: check_secret | ||
| env: | ||
| DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }} | ||
| run: | | ||
| if [ -z "$DISCORD_WEBHOOK" ]; then | ||
| echo "::warning::Missing required secret: DISCORD_WEBHOOK. Skipping advisory notification. Add a Discord webhook URL as the DISCORD_WEBHOOK secret in your repository or organization settings." | ||
| echo "skip=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "skip=false" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| - name: Send Discord notification | ||
| if: steps.check_secret.outputs.skip == 'false' | ||
| env: | ||
| DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }} | ||
| ADVISORY_TITLE: ${{ github.event.repository_advisory.summary }} | ||
| ADVISORY_SEVERITY: ${{ github.event.repository_advisory.severity }} | ||
| ADVISORY_STATE: ${{ github.event.repository_advisory.state }} | ||
| ADVISORY_CVE: ${{ github.event.repository_advisory.cve_id }} | ||
| ADVISORY_URL: ${{ github.event.repository_advisory.html_url }} | ||
| ADVISORY_DESCRIPTION: ${{ github.event.repository_advisory.description }} | ||
| ADVISORY_ACTION: ${{ github.event.action }} | ||
| REPO: ${{ github.repository }} | ||
| ACTOR: ${{ github.actor }} | ||
| run: | | ||
| # Map severity to a Discord embed colour (decimal RGB) | ||
| case "${ADVISORY_SEVERITY,,}" in | ||
| critical) COLOR=9831467 ;; # #960B0B dark red | ||
| high) COLOR=15548997 ;; # #ED4245 red | ||
| medium) COLOR=15105570 ;; # #E67E22 orange | ||
| low) COLOR=16776960 ;; # #FFFF00 yellow | ||
| *) COLOR=8421504 ;; # #808080 grey | ||
| esac | ||
| # Build optional CVE field entry | ||
| CVE_FIELD="" | ||
| if [ -n "$ADVISORY_CVE" ]; then | ||
| CVE_FIELD=$(jq -n --arg cve "$ADVISORY_CVE" \ | ||
| '{name: "CVE ID", value: $cve, inline: true}') | ||
| CVE_FIELD=",${CVE_FIELD}" | ||
| fi | ||
| # Truncate description to Discord's 1024-char field limit | ||
| DESCRIPTION="${ADVISORY_DESCRIPTION:0:1024}" | ||
| PAYLOAD=$(jq -n \ | ||
| --arg title "馃敀 Security Advisory ${ADVISORY_ACTION^} in \`${REPO}\`" \ | ||
| --arg footer_text "GitHub Advisory 路 ${REPO}" \ | ||
| --arg url "$ADVISORY_URL" \ | ||
| --arg adv_title "$ADVISORY_TITLE" \ | ||
| --arg severity "${ADVISORY_SEVERITY^}" \ | ||
| --arg state "${ADVISORY_STATE^}" \ | ||
| --arg actor "$ACTOR" \ | ||
| --arg description "$DESCRIPTION" \ | ||
| --argjson color "$COLOR" \ | ||
| '{ | ||
| embeds: [{ | ||
| title: $title, | ||
| url: $url, | ||
| color: $color, | ||
| fields: [ | ||
| {name: "Title", value: $adv_title, inline: false}, | ||
| {name: "Severity", value: $severity, inline: true}, | ||
| {name: "State", value: $state, inline: true}, | ||
| {name: "Reported by", value: $actor, inline: true}, | ||
| {name: "Description", value: $description, inline: false} | ||
| ], | ||
| footer: {text: $footer_text} | ||
| }] | ||
| }') | ||
| # Inject optional CVE field before the description field | ||
| if [ -n "$CVE_FIELD" ]; then | ||
| PAYLOAD=$(echo "$PAYLOAD" | jq \ | ||
| --argjson cve_field "$CVE_FIELD" \ | ||
| '.embeds[0].fields |= .[:3] + [$cve_field] + .[3:]') | ||
| fi | ||
| RESPONSE=$(curl -sS -o /tmp/discord_response.txt -w "%{http_code}" \ | ||
| -X POST "$DISCORD_WEBHOOK" \ | ||
| -H "Content-Type: application/json" \ | ||
| -d "$PAYLOAD") | ||
| if [ "$RESPONSE" -lt 200 ] || [ "$RESPONSE" -ge 300 ]; then | ||
| echo "::error::Discord webhook failed (HTTP $RESPONSE): $(cat /tmp/discord_response.txt)" | ||
| exit 1 | ||
| fi | ||
