External/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-08 07:37:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: deliver announcements through a scoped Discord webhook (#2737)

Browse Source 
* test: reproduce Discord webhook announcement gap

* fix: deliver ECC announcements through channel webhook

* test: cover webhook replay and least privilege

* fix: make webhook delivery durable and least privilege

* test: cover trusted receipts and cross-workflow races

* fix: serialize and authenticate announcement receipts
This commit is contained in:
Affaan Mustafa
2026-08-09 16:41:27 -04:00
committed by GitHub
parent 2d46e80e09
commit cdbb25bf9d
6 changed files with 174 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ci/release-announce-workflow.test.js
+10 -2
View File
@@ -10,16 +10,24 @@ const releaseWorkflow = fs.readFileSync(path.join(root, '.github/workflows/relea
assert.match(discussionWorkflow, /discussion:\s*\n\s*types:\s*\[created\]/);
assert.match(discussionWorkflow, /category\.name\s*==\s*'Announcements'/);
assert.match(discussionWorkflow, /concurrency:/);
assert.match(discussionWorkflow, /group:\s*ecc-discord-announcement-delivery/);
assert.doesNotMatch(discussionWorkflow, /pull_request_target|workflow_run/);
assert.match(discussionWorkflow, /persist-credentials:\s*false/);
assert.match(discussionWorkflow, /ANNOUNCEMENT_KIND:\s*discussion/);
assert.doesNotMatch(discussionWorkflow, /GITHUB_TOKEN|discussions:\s*write/);
assert.match(discussionWorkflow, /ANNOUNCEMENT_KIND:.*'manual'.*'discussion'/);
assert.match(discussionWorkflow, /workflow_dispatch:/);
assert.match(discussionWorkflow, /discussion_number:/);
assert.match(discussionWorkflow, /DISCORD_ANNOUNCE_WEBHOOK_URL:\s*\$\{\{ secrets\.DISCORD_ANNOUNCE_WEBHOOK_URL \}\}/);
assert.match(discussionWorkflow, /GITHUB_TOKEN/);
assert.match(discussionWorkflow, /discussions:\s*write/);
assert.doesNotMatch(discussionWorkflow, /DISCORD_BOT_TOKEN|DISCORD_ANNOUNCE_CHANNEL_ID/);
assert.match(releaseAnnounceWorkflow, /workflow_run:/);
assert.match(releaseAnnounceWorkflow, /workflows:\s*\[Release\]/);
assert.match(releaseAnnounceWorkflow, /conclusion\s*==\s*'success'/);
assert.match(releaseAnnounceWorkflow, /ref:\s*\$\{\{ github\.event\.repository\.default_branch \}\}/);
assert.match(releaseAnnounceWorkflow, /ANNOUNCEMENT_KIND:\s*release/);
assert.match(releaseAnnounceWorkflow, /discussions:\s*write/);
assert.match(releaseAnnounceWorkflow, /group:\s*ecc-discord-announcement-delivery/);
assert.doesNotMatch(releaseAnnounceWorkflow, /DISCORD_BOT_TOKEN|DISCORD_ANNOUNCE_CHANNEL_ID/);
assert.doesNotMatch(releaseWorkflow, /DISCORD_BOT_TOKEN|ANNOUNCEMENT_KIND/);
console.log('release announcement workflow contract: ok');