releasability.yml

name: Releasability status

on:
  workflow_run:
    workflows: ["Build"]
    types:
      - completed
    branches:
      - main
      - branch-*
  workflow_dispatch:

jobs:
  releasability-status:
    name: Releasability status
    runs-on: sonar-xs-public
    permissions:
      id-token: write
      statuses: write
      contents: read
    if: github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch'
    steps:
      - uses: SonarSource/gh-action_releasability/releasability-status@v3
        env:
          GITHUB_TOKEN: ${{ github.token }}

  slack-notifications:
    runs-on: github-ubuntu-latest-s # Public GH runner is required, runners starting with sonar-* do not support this action
    if: failure()
    needs: [ releasability-status ]
    permissions:
      id-token: write
    steps:
      - name: Vault Secrets
        id: secrets
        uses: SonarSource/vault-action-wrapper@v3
        with:
          secrets: |
            development/kv/data/slack token | SLACK_TOKEN;

      - name: Slack Notification rtCamp
        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661  # v2.3.3
        env:
          SLACK_TOKEN: >-
            ${{ fromJSON(steps.secrets.outputs.vault).SLACK_TOKEN }}
          SLACK_CHANNEL: ops-sonarcloud-webapp
          SLACK_TITLE: "Releasability check Failed 🚨"
          SLACK_USERNAME: BuildBot
          SLACK_COLOR: ${{ job.status }}
          SLACK_MESSAGE: |
            Workflow failed in ${{ github.repository }}
            ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
            Branch: ${{ github.head_ref || github.ref_name }}