diff --git a/.github/workflows/notify-telegram-issue-shared.yml b/.github/workflows/notify-telegram-issue-shared.yml index 1e5ecc0..7e5d72a 100644 --- a/.github/workflows/notify-telegram-issue-shared.yml +++ b/.github/workflows/notify-telegram-issue-shared.yml @@ -1,10 +1,13 @@ name: Notify Telegram issue (shared) on: workflow_call: - secrets: - TELEGRAM_BOT_TOKEN: + inputs: + telegram-chat-id: + description: Telegram chat ID that receives notifications. required: true - TELEGRAM_CHAT_ID: + type: string + secrets: + telegram-bot-token: required: true jobs: notify-closed: @@ -21,6 +24,6 @@ jobs: uses: $/.github/actions/send-telegram-message with: message: ${{ steps.prepare.outputs.message }} - telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }} - telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }} + telegram-bot-token: ${{ secrets.telegram-bot-token }} + telegram-chat-id: ${{ inputs.telegram-chat-id }} parse-mode: MarkdownV2 diff --git a/.github/workflows/notify-telegram-pr-shared.yml b/.github/workflows/notify-telegram-pr-shared.yml index 749873c..efcff10 100644 --- a/.github/workflows/notify-telegram-pr-shared.yml +++ b/.github/workflows/notify-telegram-pr-shared.yml @@ -1,10 +1,13 @@ name: Notify Telegram PR (shared) on: workflow_call: - secrets: - TELEGRAM_BOT_TOKEN: + inputs: + telegram-chat-id: + description: Telegram chat ID that receives notifications. required: true - TELEGRAM_CHAT_ID: + type: string + secrets: + telegram-bot-token: required: true jobs: notify: @@ -25,6 +28,6 @@ jobs: uses: $/.github/actions/send-telegram-message with: message: ${{ steps.prepare.outputs.message }} - telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }} - telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }} + telegram-bot-token: ${{ secrets.telegram-bot-token }} + telegram-chat-id: ${{ inputs.telegram-chat-id }} parse-mode: MarkdownV2 diff --git a/.github/workflows/notify-telegram-pr.yml b/.github/workflows/notify-telegram-pr.yml index 599090e..f4fd42b 100644 --- a/.github/workflows/notify-telegram-pr.yml +++ b/.github/workflows/notify-telegram-pr.yml @@ -8,6 +8,7 @@ on: jobs: notify: uses: ./.github/workflows/notify-telegram-pr-shared.yml + with: + telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }} secrets: - TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} - TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }} + telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }} diff --git a/.github/workflows/notify-telegram-release-shared.yml b/.github/workflows/notify-telegram-release-shared.yml index 127c5d5..ac08ccf 100644 --- a/.github/workflows/notify-telegram-release-shared.yml +++ b/.github/workflows/notify-telegram-release-shared.yml @@ -1,10 +1,13 @@ name: Notify Telegram release (shared) on: workflow_call: - secrets: - TELEGRAM_BOT_TOKEN: + inputs: + telegram-chat-id: + description: Telegram chat ID that receives notifications. required: true - TELEGRAM_CHAT_ID: + type: string + secrets: + telegram-bot-token: required: true jobs: notify: @@ -20,6 +23,6 @@ jobs: uses: $/.github/actions/send-telegram-message with: message: ${{ steps.prepare.outputs.message }} - telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }} - telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }} + telegram-bot-token: ${{ secrets.telegram-bot-token }} + telegram-chat-id: ${{ inputs.telegram-chat-id }} parse-mode: MarkdownV2 diff --git a/.github/workflows/notify-telegram-release.yml b/.github/workflows/notify-telegram-release.yml index 392b973..60f6b22 100644 --- a/.github/workflows/notify-telegram-release.yml +++ b/.github/workflows/notify-telegram-release.yml @@ -5,6 +5,7 @@ on: jobs: notify: uses: ./.github/workflows/notify-telegram-release-shared.yml + with: + telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }} secrets: - TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} - TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }} + telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }} diff --git a/README.md b/README.md index a5f0dcf..6937e73 100644 --- a/README.md +++ b/README.md @@ -128,9 +128,10 @@ on: jobs: notify: uses: rubykatzen/baseline/.github/workflows/notify-telegram-pr-shared.yml@v0.16.2 + with: + telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }} secrets: - TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} - TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }} + telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }} ``` @@ -141,7 +142,8 @@ digests do not send a message. `pull_request_target` keeps Telegram secrets available while loading trusted workflow code from the default branch. The shared workflow does not check out -or execute pull request code. Pass the two secrets explicitly rather than using +or execute pull request code. Store `TELEGRAM_CHAT_ID` as an Actions variable, +keep `TELEGRAM_BOT_TOKEN` as a secret, and pass both explicitly rather than using `secrets: inherit`. ## Notify Telegram about releases @@ -158,16 +160,17 @@ on: jobs: notify: uses: rubykatzen/baseline/.github/workflows/notify-telegram-release-shared.yml@v0.16.2 + with: + telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }} secrets: - TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} - TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }} + telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }} ``` Baseline sends one notification when a release or prerelease is published. The -release tag links to the GitHub Release. Pass the two secrets explicitly rather -than using `secrets: inherit`. +release tag links to the GitHub Release. Pass the chat ID as an Actions variable +and the bot token as a secret. ## Notify Telegram about closed issues @@ -185,9 +188,10 @@ jobs: notify: if: contains(github.event.issue.labels.*.name, 'notify') uses: rubykatzen/baseline/.github/workflows/notify-telegram-issue-shared.yml@v0.16.2 + with: + telegram-chat-id: ${{ vars.TELEGRAM_ISSUE_CHAT_ID }} secrets: - TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} - TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_ISSUE_CHAT_ID }} + telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }} ``` diff --git a/test/test_telegram_notifications.py b/test/test_telegram_notifications.py index 029f9c2..4a2dde7 100644 --- a/test/test_telegram_notifications.py +++ b/test/test_telegram_notifications.py @@ -258,6 +258,31 @@ def load_workflow(self, name): with open(BASELINE_ROOT / ".github" / "workflows" / name) as workflow: return yaml.safe_load(workflow) + def test_shared_workflows_accept_chat_id_as_input(self): + for name in ( + "notify-telegram-pr-shared.yml", + "notify-telegram-issue-shared.yml", + "notify-telegram-release-shared.yml", + ): + workflow = self.load_workflow(name) + workflow_call = workflow[True]["workflow_call"] + job = next(iter(workflow["jobs"].values())) + + with self.subTest(name=name): + self.assertEqual(set(workflow_call["secrets"]), {"telegram-bot-token"}) + self.assertEqual( + workflow_call["inputs"]["telegram-chat-id"], + { + "description": "Telegram chat ID that receives notifications.", + "required": True, + "type": "string", + }, + ) + self.assertEqual( + job["steps"][-1]["with"]["telegram-chat-id"], + "${{ inputs.telegram-chat-id }}", + ) + def test_pr_workflow_prepares_and_sends_supported_events(self): workflow = self.load_workflow("notify-telegram-pr-shared.yml") job = workflow["jobs"]["notify"] @@ -308,15 +333,16 @@ def test_release_workflow_only_sends_published_release_notification(self): ) self.assertEqual(job["steps"][-1]["with"]["parse-mode"], "MarkdownV2") - def test_baseline_callers_pass_only_explicit_telegram_secrets(self): + def test_baseline_callers_pass_chat_id_as_variable_input(self): for name in ("notify-telegram-pr.yml", "notify-telegram-release.yml"): path = BASELINE_ROOT / ".github" / "workflows" / name content = path.read_text() workflow = yaml.safe_load(content) - secrets = workflow["jobs"]["notify"]["secrets"] + job = workflow["jobs"]["notify"] with self.subTest(name=name): - self.assertEqual(set(secrets), {"TELEGRAM_BOT_TOKEN", "TELEGRAM_CHAT_ID"}) + self.assertEqual(set(job["secrets"]), {"telegram-bot-token"}) + self.assertEqual(job["with"]["telegram-chat-id"], "${{ vars.TELEGRAM_CHAT_ID }}") self.assertNotIn("secrets: inherit", content) def test_baseline_release_caller_uses_published_event(self):