teams-notify.yml

# This workflow will run when a new Pull Request is opened or reopened, and a new issue is opened.
# This workflow only notifies Hyperjump's Microsoft Teams. Nothing else.
# WARNING: Since this PR uses pull_request_target trigger, DO NOT BUILD THE PROJECT IN THIS WORKFLOW!
# For more information: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
# To PR reviewers: Please make sure there is no build steps in this workflow.

name: Notify Teams

on:
  issues:
    types: [opened]
  pull_request_target:
    types: [opened, reopened]
permissions:
  issues: read
  pull-requests: read
jobs:
  notify:
    runs-on: ubuntu-latest
    steps:
      - name: Set variables
        id: set_variables
        env:
          ISSUE_TITLE: ${{ github.event.issue.title }}
          PR_TITLE: ${{ github.event.pull_request.title }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
        run: |
          if [ "$GITHUB_EVENT_NAME" = "issues" ]; then
              echo "::set-output name=webhook_title::New issue opened: $ISSUE_TITLE" 
              echo "::set-output name=webhook_text::${{ github.event.issue.html_url }}" 
          else
              echo "::set-output name=webhook_title::New PR opened: $PR_TITLE" 
              echo "::set-output name=webhook_text::${{ github.event.pull_request.html_url }}"   
          fi
      - name: Notify Teams
        uses: joelwmale/webhook-action@master
        with:
          url: ${{secrets.HYPERJUMP_TEAMS_SYMON_WEBHOOK}}
          body: '{"title": "${{ steps.set_variables.outputs.webhook_title }}", "text": "${{ steps.set_variables.outputs.webhook_text }}"}'