Leaky Secret

1name: Notify
2
3on:
4  workflow_run:
5    workflows: ["Build and Push"]
6    types:
7      - completed
8
9permissions: {}
10
11jobs:
12  notify:
13    name: Send Slack notification
14    runs-on: ubuntu-24.04
15    permissions:
16      contents: read
17      id-token: write
18    steps:
19      - name: Log in to Azure
20        uses: bitwarden/gh-actions/azure-login@main
21        with:
22          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
23          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
24          client_id: ${{ secrets.AZURE_CLIENT_ID }}
25
26      - name: Get Azure Key Vault secrets
27        id: secrets
28        uses: bitwarden/gh-actions/get-keyvault-secrets@main
29        with:
30          keyvault: ci-shared-kv
31          secrets: "SLACK-WEBHOOK-URL"
32
33      - name: Log out from Azure
34        uses: bitwarden/gh-actions/azure-logout@main
35
36      - name: Send notification
37        run: |
38          echo "Using webhook ${{ steps.secrets.outputs.SLACK-WEBHOOK-URL }}"
39          echo "SLACK_WEBHOOK=${{ steps.secrets.outputs.SLACK-WEBHOOK-URL }}" >> notify.env
40          curl -X POST -d '{"text":"build done"}' ${{ steps.secrets.outputs.SLACK-WEBHOOK-URL }}