Skip to content

Commit cc31610

Browse files
StasonJathamStasonJatham
committed
Add Discord notifications for security update failures
Enhanced both security workflows with Discord webhook integration: Security Updates Workflow: - Sends Discord notification when tests fail after dependency upgrade - Sends Discord notification when dependency upgrade fails - Includes security report, test output, and workflow links - Color-coded embeds (red for critical, yellow for warnings) Dependabot Auto-Merge Workflow: - Sends Discord notification when Dependabot PR tests fail - Includes PR link, test output, and failure details - Allows manual intervention when automation fails Notification Format: - Rich embeds with structured information - Direct links to PRs and workflow runs - Last 50 lines of test output for debugging - Security report details - Timestamps for tracking Configuration: - Requires DISCORD_WEBHOOK secret in GitHub repo settings - Webhook URL should be full Discord webhook URL with https:// This ensures you're immediately notified when security updates need manual attention.
1 parent b5210cc commit cc31610

3 files changed

Lines changed: 190 additions & 7 deletions

File tree

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 71 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,15 +29,21 @@ jobs:
2929
3030
- name: Run unit tests
3131
id: unit_tests
32+
continue-on-error: true
3233
run: |
33-
pytest tests/test_validator.py -v --tb=short
34-
echo "unit_tests_passed=true" >> $GITHUB_OUTPUT
34+
pytest tests/test_validator.py -v --tb=short > test-output.txt 2>&1
35+
if [ $? -eq 0 ]; then
36+
echo "unit_tests_passed=true" >> $GITHUB_OUTPUT
37+
fi
3538
3639
- name: Run CLI tests
3740
id: cli_tests
41+
continue-on-error: true
3842
run: |
39-
pytest tests/test_cli.py -v --tb=short
40-
echo "cli_tests_passed=true" >> $GITHUB_OUTPUT
43+
pytest tests/test_cli.py -v --tb=short >> test-output.txt 2>&1
44+
if [ $? -eq 0 ]; then
45+
echo "cli_tests_passed=true" >> $GITHUB_OUTPUT
46+
fi
4147
4248
- name: Check if security update
4349
id: check_security
@@ -119,3 +125,64 @@ This release was automatically created after Dependabot's security updates passe
119125
See PR #${{ github.event.pull_request.number }} for details."
120126

121127
echo "✅ Created release v$NEW_VERSION"
128+
129+
- name: Send Discord notification on test failure
130+
if: |
131+
steps.unit_tests.outputs.unit_tests_passed != 'true' ||
132+
steps.cli_tests.outputs.cli_tests_passed != 'true'
133+
env:
134+
DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
135+
run: |
136+
TEST_OUTPUT=$(cat test-output.txt 2>/dev/null | tail -50 || echo "No test output available")
137+
TEST_OUTPUT=$(echo "$TEST_OUTPUT" | jq -Rs .)
138+
139+
PR_TITLE=$(gh pr view ${{ github.event.pull_request.number }} --json title --jq .title)
140+
PR_URL="https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}"
141+
142+
curl -H "Content-Type: application/json" \
143+
-d "{
144+
\"embeds\": [{
145+
\"title\": \"🚨 Dependabot PR Tests Failed - Manual Review Required\",
146+
\"description\": \"A Dependabot security update PR has failing tests.\",
147+
\"color\": 15158332,
148+
\"fields\": [
149+
{
150+
\"name\": \"Repository\",
151+
\"value\": \"${{ github.repository }}\",
152+
\"inline\": true
153+
},
154+
{
155+
\"name\": \"PR\",
156+
\"value\": \"[#${{ github.event.pull_request.number }}]($PR_URL)\",
157+
\"inline\": true
158+
},
159+
{
160+
\"name\": \"Run ID\",
161+
\"value\": \"[${{ github.run_id }}](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})\",
162+
\"inline\": true
163+
},
164+
{
165+
\"name\": \"⚠️ Issue\",
166+
\"value\": \"Dependabot created a security update PR but tests failed.\",
167+
\"inline\": false
168+
},
169+
{
170+
\"name\": \"📋 PR Title\",
171+
\"value\": \"$PR_TITLE\",
172+
\"inline\": false
173+
},
174+
{
175+
\"name\": \"🧪 Test Output (last 50 lines)\",
176+
\"value\": \"\`\`\`\n\" + $TEST_OUTPUT + \"\n\`\`\`\",
177+
\"inline\": false
178+
},
179+
{
180+
\"name\": \"🔗 Actions\",
181+
\"value\": \"Please review the [PR]($PR_URL) and [workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) to fix the failing tests.\",
182+
\"inline\": false
183+
}
184+
],
185+
\"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
186+
}]
187+
}" \
188+
"$DISCORD_WEBHOOK"

‎.github/workflows/security-updates.yml‎

Lines changed: 118 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,10 @@ jobs:
7373
- name: Run all tests
7474
if: steps.fix_vulnerabilities.outputs.updated == 'true'
7575
id: run_tests
76+
continue-on-error: true
7677
run: |
77-
pytest tests/test_validator.py -v --tb=short
78-
pytest tests/test_cli.py -v --tb=short
78+
pytest tests/test_validator.py -v --tb=short > test-output.txt 2>&1
79+
pytest tests/test_cli.py -v --tb=short >> test-output.txt 2>&1
7980
echo "tests_passed=true" >> $GITHUB_OUTPUT
8081
8182
- name: Get current version
@@ -188,6 +189,121 @@ EOF
188189
echo "PR will merge automatically once all checks pass"
189190
fi
190191
192+
- name: Send Discord notification on test failure
193+
if: |
194+
steps.fix_vulnerabilities.outputs.updated == 'true' &&
195+
steps.run_tests.outputs.tests_passed != 'true'
196+
env:
197+
DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
198+
run: |
199+
SECURITY_REPORT=$(cat security-report.txt 2>/dev/null | head -30 || echo "No security report available")
200+
TEST_OUTPUT=$(cat test-output.txt 2>/dev/null | tail -50 || echo "No test output available")
201+
202+
# Escape JSON special characters
203+
SECURITY_REPORT=$(echo "$SECURITY_REPORT" | jq -Rs .)
204+
TEST_OUTPUT=$(echo "$TEST_OUTPUT" | jq -Rs .)
205+
206+
curl -H "Content-Type: application/json" \
207+
-d "{
208+
\"embeds\": [{
209+
\"title\": \"🚨 Security Update Failed - Manual Review Required\",
210+
\"description\": \"A security update was attempted but tests failed. Manual intervention is needed.\",
211+
\"color\": 15158332,
212+
\"fields\": [
213+
{
214+
\"name\": \"Repository\",
215+
\"value\": \"${{ github.repository }}\",
216+
\"inline\": true
217+
},
218+
{
219+
\"name\": \"Workflow\",
220+
\"value\": \"Security Updates\",
221+
\"inline\": true
222+
},
223+
{
224+
\"name\": \"Run ID\",
225+
\"value\": \"[${{ github.run_id }}](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})\",
226+
\"inline\": true
227+
},
228+
{
229+
\"name\": \"⚠️ Issue\",
230+
\"value\": \"Security vulnerabilities were found and dependencies were updated, but tests failed after the update.\",
231+
\"inline\": false
232+
},
233+
{
234+
\"name\": \"📋 Security Report (truncated)\",
235+
\"value\": \"\`\`\`\n\" + $SECURITY_REPORT + \"\n\`\`\`\",
236+
\"inline\": false
237+
},
238+
{
239+
\"name\": \"🧪 Test Output (last 50 lines)\",
240+
\"value\": \"\`\`\`\n\" + $TEST_OUTPUT + \"\n\`\`\`\",
241+
\"inline\": false
242+
},
243+
{
244+
\"name\": \"🔗 Actions\",
245+
\"value\": \"Please review the [workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) and fix the failing tests manually.\",
246+
\"inline\": false
247+
}
248+
],
249+
\"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
250+
}]
251+
}" \
252+
"$DISCORD_WEBHOOK"
253+
254+
- name: Send Discord notification on upgrade failure
255+
if: |
256+
(steps.pip_audit.outputs.vulnerabilities_found == 'true' || steps.safety_check.outputs.safety_issues == 'true') &&
257+
steps.fix_vulnerabilities.outputs.updated != 'true'
258+
env:
259+
DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
260+
run: |
261+
SECURITY_REPORT=$(cat security-report.txt 2>/dev/null || echo "No security report available")
262+
SECURITY_REPORT=$(echo "$SECURITY_REPORT" | jq -Rs .)
263+
264+
curl -H "Content-Type: application/json" \
265+
-d "{
266+
\"embeds\": [{
267+
\"title\": \"⚠️ Security Vulnerabilities Found - Upgrade Failed\",
268+
\"description\": \"Security vulnerabilities detected but automatic upgrade failed.\",
269+
\"color\": 16776960,
270+
\"fields\": [
271+
{
272+
\"name\": \"Repository\",
273+
\"value\": \"${{ github.repository }}\",
274+
\"inline\": true
275+
},
276+
{
277+
\"name\": \"Workflow\",
278+
\"value\": \"Security Updates\",
279+
\"inline\": true
280+
},
281+
{
282+
\"name\": \"Run ID\",
283+
\"value\": \"[${{ github.run_id }}](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})\",
284+
\"inline\": true
285+
},
286+
{
287+
\"name\": \"⚠️ Issue\",
288+
\"value\": \"Could not automatically upgrade dependencies. Manual upgrade required.\",
289+
\"inline\": false
290+
},
291+
{
292+
\"name\": \"📋 Security Report\",
293+
\"value\": \"\`\`\`\n\" + $SECURITY_REPORT + \"\n\`\`\`\",
294+
\"inline\": false
295+
},
296+
{
297+
\"name\": \"🔗 Actions\",
298+
\"value\": \"Please review the [workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) and upgrade dependencies manually.\",
299+
\"inline\": false
300+
}
301+
],
302+
\"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
303+
}]
304+
}" \
305+
"$DISCORD_WEBHOOK"
306+
191307
- name: No vulnerabilities found
192308
if: steps.pip_audit.outputs.vulnerabilities_found != 'true' && steps.safety_check.outputs.safety_issues != 'true'
193309
run: |

‎pyresolvers/lib/core/__version__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
__version__ = '2.1.0'
1+
__version__ = '2.1.1'
22

0 commit comments

Comments
 (0)