Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions .github/workflows/notify-telegram-issue-shared.yml
Original file line number Diff line number Diff line change
@@ -1,10 +1,13 @@
name: Notify Telegram issue (shared)
on:
workflow_call:
secrets:
TELEGRAM_BOT_TOKEN:
inputs:
telegram-chat-id:
description: Telegram chat ID that receives notifications.
required: true
TELEGRAM_CHAT_ID:
type: string
secrets:
telegram-bot-token:
required: true
jobs:
notify-closed:
Expand All @@ -21,6 +24,6 @@ jobs:
uses: $/.github/actions/send-telegram-message
with:
message: ${{ steps.prepare.outputs.message }}
telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
telegram-bot-token: ${{ secrets.telegram-bot-token }}
telegram-chat-id: ${{ inputs.telegram-chat-id }}
parse-mode: MarkdownV2
13 changes: 8 additions & 5 deletions .github/workflows/notify-telegram-pr-shared.yml
Original file line number Diff line number Diff line change
@@ -1,10 +1,13 @@
name: Notify Telegram PR (shared)
on:
workflow_call:
secrets:
TELEGRAM_BOT_TOKEN:
inputs:
telegram-chat-id:
description: Telegram chat ID that receives notifications.
required: true
TELEGRAM_CHAT_ID:
type: string
secrets:
telegram-bot-token:
required: true
jobs:
notify:
Expand All @@ -25,6 +28,6 @@ jobs:
uses: $/.github/actions/send-telegram-message
with:
message: ${{ steps.prepare.outputs.message }}
telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
telegram-bot-token: ${{ secrets.telegram-bot-token }}
telegram-chat-id: ${{ inputs.telegram-chat-id }}
parse-mode: MarkdownV2
5 changes: 3 additions & 2 deletions .github/workflows/notify-telegram-pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ on:
jobs:
notify:
uses: ./.github/workflows/notify-telegram-pr-shared.yml
with:
telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
secrets:
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
13 changes: 8 additions & 5 deletions .github/workflows/notify-telegram-release-shared.yml
Original file line number Diff line number Diff line change
@@ -1,10 +1,13 @@
name: Notify Telegram release (shared)
on:
workflow_call:
secrets:
TELEGRAM_BOT_TOKEN:
inputs:
telegram-chat-id:
description: Telegram chat ID that receives notifications.
required: true
TELEGRAM_CHAT_ID:
type: string
secrets:
telegram-bot-token:
required: true
jobs:
notify:
Expand All @@ -20,6 +23,6 @@ jobs:
uses: $/.github/actions/send-telegram-message
with:
message: ${{ steps.prepare.outputs.message }}
telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
telegram-bot-token: ${{ secrets.telegram-bot-token }}
telegram-chat-id: ${{ inputs.telegram-chat-id }}
parse-mode: MarkdownV2
5 changes: 3 additions & 2 deletions .github/workflows/notify-telegram-release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ on:
jobs:
notify:
uses: ./.github/workflows/notify-telegram-release-shared.yml
with:
telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
secrets:
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
22 changes: 13 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -128,9 +128,10 @@ on:
jobs:
notify:
uses: rubykatzen/baseline/.github/workflows/notify-telegram-pr-shared.yml@v0.16.2
with:
telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
secrets:
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
```

<!-- x-release-please-end -->
Expand All @@ -141,7 +142,8 @@ digests do not send a message.

`pull_request_target` keeps Telegram secrets available while loading trusted
workflow code from the default branch. The shared workflow does not check out
or execute pull request code. Pass the two secrets explicitly rather than using
or execute pull request code. Store `TELEGRAM_CHAT_ID` as an Actions variable,
keep `TELEGRAM_BOT_TOKEN` as a secret, and pass both explicitly rather than using
`secrets: inherit`.

## Notify Telegram about releases
Expand All @@ -158,16 +160,17 @@ on:
jobs:
notify:
uses: rubykatzen/baseline/.github/workflows/notify-telegram-release-shared.yml@v0.16.2
with:
telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
secrets:
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
```

<!-- x-release-please-end -->

Baseline sends one notification when a release or prerelease is published. The
release tag links to the GitHub Release. Pass the two secrets explicitly rather
than using `secrets: inherit`.
release tag links to the GitHub Release. Pass the chat ID as an Actions variable
and the bot token as a secret.

## Notify Telegram about closed issues

Expand All @@ -185,9 +188,10 @@ jobs:
notify:
if: contains(github.event.issue.labels.*.name, 'notify')
uses: rubykatzen/baseline/.github/workflows/notify-telegram-issue-shared.yml@v0.16.2
with:
telegram-chat-id: ${{ vars.TELEGRAM_ISSUE_CHAT_ID }}
secrets:
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_ISSUE_CHAT_ID }}
telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
```

<!-- x-release-please-end -->
Expand Down
32 changes: 29 additions & 3 deletions test/test_telegram_notifications.py
Original file line number Diff line number Diff line change
Expand Up @@ -258,6 +258,31 @@ def load_workflow(self, name):
with open(BASELINE_ROOT / ".github" / "workflows" / name) as workflow:
return yaml.safe_load(workflow)

def test_shared_workflows_accept_chat_id_as_input(self):
for name in (
"notify-telegram-pr-shared.yml",
"notify-telegram-issue-shared.yml",
"notify-telegram-release-shared.yml",
):
workflow = self.load_workflow(name)
workflow_call = workflow[True]["workflow_call"]
job = next(iter(workflow["jobs"].values()))

with self.subTest(name=name):
self.assertEqual(set(workflow_call["secrets"]), {"telegram-bot-token"})
self.assertEqual(
workflow_call["inputs"]["telegram-chat-id"],
{
"description": "Telegram chat ID that receives notifications.",
"required": True,
"type": "string",
},
)
self.assertEqual(
job["steps"][-1]["with"]["telegram-chat-id"],
"${{ inputs.telegram-chat-id }}",
)

def test_pr_workflow_prepares_and_sends_supported_events(self):
workflow = self.load_workflow("notify-telegram-pr-shared.yml")
job = workflow["jobs"]["notify"]
Expand Down Expand Up @@ -308,15 +333,16 @@ def test_release_workflow_only_sends_published_release_notification(self):
)
self.assertEqual(job["steps"][-1]["with"]["parse-mode"], "MarkdownV2")

def test_baseline_callers_pass_only_explicit_telegram_secrets(self):
def test_baseline_callers_pass_chat_id_as_variable_input(self):
for name in ("notify-telegram-pr.yml", "notify-telegram-release.yml"):
path = BASELINE_ROOT / ".github" / "workflows" / name
content = path.read_text()
workflow = yaml.safe_load(content)
secrets = workflow["jobs"]["notify"]["secrets"]
job = workflow["jobs"]["notify"]

with self.subTest(name=name):
self.assertEqual(set(secrets), {"TELEGRAM_BOT_TOKEN", "TELEGRAM_CHAT_ID"})
self.assertEqual(set(job["secrets"]), {"telegram-bot-token"})
self.assertEqual(job["with"]["telegram-chat-id"], "${{ vars.TELEGRAM_CHAT_ID }}")
self.assertNotIn("secrets: inherit", content)

def test_baseline_release_caller_uses_published_event(self):
Expand Down