Add security advisory email notification workflow #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Advisory Email Notification | ||
|
Check failure on line 1 in .github/workflows/advisory-email-notify.yml
|
||
| on: | ||
| repository_advisory: | ||
| types: [reported, created, published, submitted, reopened] | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| notify-owners: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Ensure SMTP secrets are configured | ||
| id: check_secrets | ||
| env: | ||
| MAIL_SERVER: ${{ secrets.ADVISORY_MAIL_SERVER }} | ||
| MAIL_USERNAME: ${{ secrets.ADVISORY_MAIL_USERNAME }} | ||
| MAIL_PASSWORD: ${{ secrets.ADVISORY_MAIL_PASSWORD }} | ||
| MAIL_TO: ${{ secrets.ADVISORY_MAIL_TO }} | ||
| run: | | ||
| missing=() | ||
| [ -z "$MAIL_SERVER" ] && missing+=("ADVISORY_MAIL_SERVER") | ||
| [ -z "$MAIL_USERNAME" ] && missing+=("ADVISORY_MAIL_USERNAME") | ||
| [ -z "$MAIL_PASSWORD" ] && missing+=("ADVISORY_MAIL_PASSWORD") | ||
| [ -z "$MAIL_TO" ] && missing+=("ADVISORY_MAIL_TO") | ||
| if [ ${#missing[@]} -gt 0 ]; then | ||
| echo "::warning::Missing required secrets: ${missing[*]}. Skipping advisory email notification. Configure these secrets in your repository or organization settings." | ||
| echo "skip=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "skip=false" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| - name: Build email body | ||
| if: steps.check_secrets.outputs.skip == 'false' | ||
| id: build_body | ||
| env: | ||
| ADVISORY_TITLE: ${{ github.event.repository_advisory.summary }} | ||
| ADVISORY_SEVERITY: ${{ github.event.repository_advisory.severity }} | ||
| ADVISORY_STATE: ${{ github.event.repository_advisory.state }} | ||
| ADVISORY_CVE: ${{ github.event.repository_advisory.cve_id }} | ||
| ADVISORY_URL: ${{ github.event.repository_advisory.html_url }} | ||
| ADVISORY_DESCRIPTION: ${{ github.event.repository_advisory.description }} | ||
| ADVISORY_ACTION: ${{ github.event.action }} | ||
| REPO: ${{ github.repository }} | ||
| ACTOR: ${{ github.actor }} | ||
| run: | | ||
| CVE_LINE="" | ||
| if [ -n "$ADVISORY_CVE" ]; then | ||
| CVE_LINE="CVE ID : $ADVISORY_CVE"$'\n' | ||
| fi | ||
| BODY="A security advisory has been ${ADVISORY_ACTION} on the repository ${REPO}. | ||
| Repository : https://github.com/${REPO} | ||
| Action : ${ADVISORY_ACTION} | ||
| Title : ${ADVISORY_TITLE} | ||
| Severity : ${ADVISORY_SEVERITY} | ||
| State : ${ADVISORY_STATE} | ||
| ${CVE_LINE}Advisory : ${ADVISORY_URL} | ||
| Reported by: ${ACTOR} | ||
| --- Description --- | ||
| ${ADVISORY_DESCRIPTION} | ||
| --- | ||
| This notification was sent automatically by GitHub Actions. | ||
| Repository: https://github.com/${REPO} | ||
| " | ||
| # Write to file to avoid multiline env issues | ||
| printf '%s' "$BODY" > /tmp/advisory_body.txt | ||
| echo "body_file=/tmp/advisory_body.txt" >> "$GITHUB_OUTPUT" | ||
| - name: Send email to org owners | ||
| if: steps.check_secrets.outputs.skip == 'false' | ||
| # dawidd6/action-send-mail v3.12.0 — pinned to exact commit for supply-chain security. | ||
| # Verify: https://github.com/dawidd6/action-send-mail/commit/2cea9617b09d83a84e7015b8b4c893f01b028020 | ||
| uses: dawidd6/action-send-mail@2cea9617b09d83a84e7015b8b4c893f01b028020 | ||
| with: | ||
| server_address: ${{ secrets.ADVISORY_MAIL_SERVER }} | ||
| # ADVISORY_MAIL_PORT defaults to 465 (SMTPS / implicit TLS). | ||
| # Set the secret to 587 and secure to false if your SMTP server requires STARTTLS instead. | ||
| server_port: ${{ secrets.ADVISORY_MAIL_PORT || 465 }} | ||
| secure: ${{ secrets.ADVISORY_MAIL_SECURE || true }} | ||
| username: ${{ secrets.ADVISORY_MAIL_USERNAME }} | ||
| password: ${{ secrets.ADVISORY_MAIL_PASSWORD }} | ||
| subject: "[Security Advisory] [${{ github.event.repository_advisory.severity }}] ${{ github.event.repository_advisory.summary }} — ${{ github.repository }}" | ||
| to: ${{ secrets.ADVISORY_MAIL_TO }} | ||
| from: "GitHub Advisory Bot <${{ secrets.ADVISORY_MAIL_USERNAME }}>" | ||
| body: file:///tmp/advisory_body.txt | ||
