Skip to content

chore(CI): add slack notifications #784

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rishav-karanjit wants to merge 2 commits into
base: master
Choose a base branch
from
Open

chore(CI): add slack notifications #784

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ea72e9e
m
rishav-karanjit Jan 9, 2026
cae50d6
Merge branch 'master' into rishav/slack-notification
rishav-karanjit Jan 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 18 additions & 1 deletion .github/workflows/daily_ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,4 +43,21 @@ jobs:
tests:
# Don't run the cron builds on forks
if: github.event_name != 'schedule' || github.repository_owner == 'aws'
uses: ./.github/workflows/ci_tests.yaml
uses: ./.github/workflows/ci_tests.yaml

notify:
needs:
[
codebuild_batch,
codebuild_tests,
decrypt_oracle,
static_analysis,
test_vector_handler,
tests
]
if: ${{ failure() }}
uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
with:
message: "Daily CI failed on `${{ github.repository }}`. View run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
secrets:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_CI }}
23 changes: 23 additions & 0 deletions .github/workflows/issue-notification.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
name: Issue Created Notification
on:
issues:
types: [opened, reopened]
issue_comment:
types: [created]

jobs:
notify-issue:
if: github.event_name == 'issues'
uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
with:
message: "New github issue `${{ github.event.issue.title }}`. Link: ${{ github.event.issue.html_url }}"
secrets:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_GHI }}

notify-comment:
Comment on lines +10 to +17

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 20 days ago

In general, the fix is to explicitly declare a permissions block in the workflow (at the top level, since neither job has its own) and restrict the default GITHUB_TOKEN permissions to the minimum necessary. This workflow only reacts to issues and issue_comment events and passes data plus a secret to a reusable Slack notification workflow; it doesn’t change repository contents or metadata itself. Therefore, the minimal safe default is contents: read, which allows basic read operations if needed while avoiding unnecessary write scopes.

The best fix without changing existing functionality is to add a top-level permissions block between the on: section and the jobs: section in .github/workflows/issue-notification.yml. Set contents: read as a conservative, least-privilege permission; if the reusable workflow needs something more, it can declare its own permissions in its own file, but that is outside the scope of this snippet. No imports or additional methods are needed, since this is purely a YAML configuration change.

Suggested changeset 1
.github/workflows/issue-notification.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/issue-notification.yml b/.github/workflows/issue-notification.yml
--- a/.github/workflows/issue-notification.yml
+++ b/.github/workflows/issue-notification.yml
@@ -5,6 +5,9 @@
   issue_comment:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   notify-issue:
     if: github.event_name == 'issues'
EOF
@@ -5,6 +5,9 @@
issue_comment:
types: [created]

permissions:
contents: read

jobs:
notify-issue:
if: github.event_name == 'issues'
Copilot is powered by AI and may make mistakes. Always verify output.
if: github.event_name == 'issue_comment' && !github.event.issue.pull_request
uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
with:
message: "New comment on issue `${{ github.event.issue.title }}`. Link: ${{ github.event.comment.html_url }}"
secrets:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_GHI }}
Comment on lines +18 to +23

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 20 days ago

In general, this issue is fixed by explicitly defining a permissions: block for the workflow or individual jobs, restricting the GITHUB_TOKEN to the minimal scopes needed. For an issue/comment notification workflow that only reads event payloads and sends a Slack message via a secret, no write permissions are needed; read-only access is sufficient, and often only contents: read (and optionally issues: read) is required.

The best fix here without changing functionality is to add a top-level permissions: block (applies to all jobs) near the top of .github/workflows/issue-notification.yml, underneath name: (or on:). Since the jobs simply consume github.event.issue and github.event.comment fields and delegate to a reusable Slack notification workflow, they do not perform any write operations on the repository. A safe and minimal configuration is:

permissions:
  contents: read
  issues: read

If the reusable workflow needs no GitHub API access, even issues: read may be unnecessary, but including it is harmless and explicit. No imports, methods, or additional definitions are needed; this is purely a YAML configuration change inside .github/workflows/issue-notification.yml.

Suggested changeset 1
.github/workflows/issue-notification.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/issue-notification.yml b/.github/workflows/issue-notification.yml
--- a/.github/workflows/issue-notification.yml
+++ b/.github/workflows/issue-notification.yml
@@ -1,4 +1,7 @@
 name: Issue Created Notification
+permissions:
+  contents: read
+  issues: read
 on:
   issues:
     types: [opened, reopened]
EOF
@@ -1,4 +1,7 @@
name: Issue Created Notification
permissions:
contents: read
issues: read
on:
issues:
types: [opened, reopened]
Copilot is powered by AI and may make mistakes. Always verify output.
Loading