Skip to content

Commit ee5200d

Browse files
james00012james00012
committed
Add Slack notifications via AWS Secrets Manager
- Add notification jobs for each account that post to Slack after all jobs complete - Fetch webhook URL from AWS Secrets Manager (PhxDevOps) to avoid hardcoding secrets - Refactor workflow for improved readability (inline region matrix, env vars for versions) - Use colored attachments (green/red) based on job results
1 parent 702b987 commit ee5200d

File tree

1 file changed

+153
-68
lines changed

1 file changed

+153
-68
lines changed

‎.github/workflows/nuke.yml‎

Lines changed: 153 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,8 @@ on:
55
branches:
66
- migrate-nuke-to-gha
77
schedule:
8-
# Every 3 hours for phxdevops and configtests
9-
- cron: '0 */3 * * *'
10-
# Nightly at midnight UTC for sandbox
11-
- cron: '0 0 * * *'
8+
- cron: '0 */3 * * *' # Every 3 hours (phxdevops, configtests)
9+
- cron: '0 0 * * *' # Nightly at midnight UTC (sandbox)
1210
workflow_dispatch:
1311
inputs:
1412
account:
@@ -26,7 +24,8 @@ permissions:
2624
contents: read
2725

2826
env:
29-
# Common exclude flags for all accounts
27+
GO_VERSION: '1.21'
28+
MISE_VERSION: '2025.12.10'
3029
COMMON_EXCLUDES: >-
3130
--exclude-resource-type iam
3231
--exclude-resource-type iam-group
@@ -41,6 +40,13 @@ env:
4140
--exclude-resource-type config-rules
4241
--exclude-resource-type nat-gateway
4342
--exclude-resource-type ec2-subnet
43+
ALL_REGIONS: >-
44+
ap-northeast-1 ap-northeast-2 ap-northeast-3
45+
ap-south-1 ap-southeast-1 ap-southeast-2
46+
ca-central-1 eu-central-1 eu-north-1
47+
eu-west-1 eu-west-2 eu-west-3
48+
me-central-1 sa-east-1
49+
us-east-1 us-east-2 us-west-1 us-west-2
4450
4551
jobs:
4652
# ============================================
@@ -62,7 +68,7 @@ jobs:
6268
aws-region: us-east-1
6369
- uses: jdx/mise-action@v3
6470
with:
65-
version: 2025.12.10
71+
version: ${{ env.MISE_VERSION }}
6672
experimental: true
6773
env:
6874
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -92,25 +98,7 @@ jobs:
9298
strategy:
9399
fail-fast: false
94100
matrix:
95-
region:
96-
- ap-northeast-1
97-
- ap-northeast-2
98-
- ap-northeast-3
99-
- ap-south-1
100-
- ap-southeast-1
101-
- ap-southeast-2
102-
- ca-central-1
103-
- eu-central-1
104-
- eu-north-1
105-
- eu-west-1
106-
- eu-west-2
107-
- eu-west-3
108-
- me-central-1
109-
- sa-east-1
110-
- us-east-1
111-
- us-east-2
112-
- us-west-1
113-
- us-west-2
101+
region: [ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-southeast-1, ap-southeast-2, ca-central-1, eu-central-1, eu-north-1, eu-west-1, eu-west-2, eu-west-3, me-central-1, sa-east-1, us-east-1, us-east-2, us-west-1, us-west-2]
114102
steps:
115103
- uses: actions/checkout@v4
116104
- uses: aws-actions/configure-aws-credentials@v4
@@ -119,7 +107,7 @@ jobs:
119107
aws-region: ${{ matrix.region }}
120108
- uses: jdx/mise-action@v3
121109
with:
122-
version: 2025.12.10
110+
version: ${{ env.MISE_VERSION }}
123111
experimental: true
124112
env:
125113
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -138,6 +126,51 @@ jobs:
138126
--region ${{ matrix.region }} ${{ env.COMMON_EXCLUDES }} \
139127
--delete-unaliased-kms-keys --log-level info
140128
129+
phxdevops_notify:
130+
name: "PhxDevOps: Notify"
131+
runs-on: ubuntu-latest
132+
if: |
133+
always() && (
134+
github.event_name == 'push' ||
135+
github.event_name == 'workflow_dispatch' && (inputs.account == 'phxdevops' || inputs.account == '') ||
136+
github.event_name == 'schedule' && github.event.schedule == '0 */3 * * *'
137+
)
138+
needs: [phxdevops_global, phxdevops_regional]
139+
steps:
140+
- uses: aws-actions/configure-aws-credentials@v4
141+
with:
142+
role-to-assume: arn:aws:iam::087285199408:role/cloud-nuke-gha
143+
aws-region: us-east-1
144+
- name: Send Slack notification
145+
run: |
146+
WEBHOOK_URL=$(aws secretsmanager get-secret-value \
147+
--secret-id cloud-nuke/slack-webhook \
148+
--query SecretString --output text)
149+
150+
if [ "${{ needs.phxdevops_global.result }}" == "success" ] && \
151+
[ "${{ needs.phxdevops_regional.result }}" == "success" ]; then
152+
STATUS="✅ Success"
153+
COLOR="good"
154+
else
155+
STATUS="❌ Failed"
156+
COLOR="danger"
157+
fi
158+
159+
curl -sS -X POST "$WEBHOOK_URL" -H "Content-Type: application/json" -d @- <<EOF
160+
{
161+
"attachments": [{
162+
"color": "${COLOR}",
163+
"blocks": [{
164+
"type": "section",
165+
"text": {
166+
"type": "mrkdwn",
167+
"text": "*PhxDevOps Nuke*: ${STATUS}\nGlobal: ${{ needs.phxdevops_global.result }} | Regional: ${{ needs.phxdevops_regional.result }}\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
168+
}
169+
}]
170+
}]
171+
}
172+
EOF
173+
141174
# ============================================
142175
# ConfigTests Account - Every 3 hours
143176
# ============================================
@@ -156,7 +189,7 @@ jobs:
156189
aws-region: us-east-1
157190
- uses: jdx/mise-action@v3
158191
with:
159-
version: 2025.12.10
192+
version: ${{ env.MISE_VERSION }}
160193
experimental: true
161194
env:
162195
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -186,25 +219,7 @@ jobs:
186219
strategy:
187220
fail-fast: false
188221
matrix:
189-
region:
190-
- ap-northeast-1
191-
- ap-northeast-2
192-
- ap-northeast-3
193-
- ap-south-1
194-
- ap-southeast-1
195-
- ap-southeast-2
196-
- ca-central-1
197-
- eu-central-1
198-
- eu-north-1
199-
- eu-west-1
200-
- eu-west-2
201-
- eu-west-3
202-
- me-central-1
203-
- sa-east-1
204-
- us-east-1
205-
- us-east-2
206-
- us-west-1
207-
- us-west-2
222+
region: [ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-southeast-1, ap-southeast-2, ca-central-1, eu-central-1, eu-north-1, eu-west-1, eu-west-2, eu-west-3, me-central-1, sa-east-1, us-east-1, us-east-2, us-west-1, us-west-2]
208223
steps:
209224
- uses: actions/checkout@v4
210225
- uses: aws-actions/configure-aws-credentials@v4
@@ -213,7 +228,7 @@ jobs:
213228
aws-region: ${{ matrix.region }}
214229
- uses: jdx/mise-action@v3
215230
with:
216-
version: 2025.12.10
231+
version: ${{ env.MISE_VERSION }}
217232
experimental: true
218233
env:
219234
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -233,6 +248,50 @@ jobs:
233248
--exclude-resource-type internet-gateway \
234249
--delete-unaliased-kms-keys --log-level info
235250
251+
configtests_notify:
252+
name: "ConfigTests: Notify"
253+
runs-on: ubuntu-latest
254+
if: |
255+
always() && (
256+
github.event_name == 'workflow_dispatch' && (inputs.account == 'configtests' || inputs.account == '') ||
257+
github.event_name == 'schedule' && github.event.schedule == '0 */3 * * *'
258+
)
259+
needs: [configtests_global, configtests_regional]
260+
steps:
261+
- uses: aws-actions/configure-aws-credentials@v4
262+
with:
263+
role-to-assume: arn:aws:iam::087285199408:role/cloud-nuke-gha
264+
aws-region: us-east-1
265+
- name: Send Slack notification
266+
run: |
267+
WEBHOOK_URL=$(aws secretsmanager get-secret-value \
268+
--secret-id cloud-nuke/slack-webhook \
269+
--query SecretString --output text)
270+
271+
if [ "${{ needs.configtests_global.result }}" == "success" ] && \
272+
[ "${{ needs.configtests_regional.result }}" == "success" ]; then
273+
STATUS="✅ Success"
274+
COLOR="good"
275+
else
276+
STATUS="❌ Failed"
277+
COLOR="danger"
278+
fi
279+
280+
curl -sS -X POST "$WEBHOOK_URL" -H "Content-Type: application/json" -d @- <<EOF
281+
{
282+
"attachments": [{
283+
"color": "${COLOR}",
284+
"blocks": [{
285+
"type": "section",
286+
"text": {
287+
"type": "mrkdwn",
288+
"text": "*ConfigTests Nuke*: ${STATUS}\nGlobal: ${{ needs.configtests_global.result }} | Regional: ${{ needs.configtests_regional.result }}\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
289+
}
290+
}]
291+
}]
292+
}
293+
EOF
294+
236295
# ============================================
237296
# Sandbox Account - Nightly
238297
# ============================================
@@ -251,7 +310,7 @@ jobs:
251310
aws-region: us-east-1
252311
- uses: jdx/mise-action@v3
253312
with:
254-
version: 2025.12.10
313+
version: ${{ env.MISE_VERSION }}
255314
experimental: true
256315
env:
257316
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -281,25 +340,7 @@ jobs:
281340
strategy:
282341
fail-fast: false
283342
matrix:
284-
region:
285-
- ap-northeast-1
286-
- ap-northeast-2
287-
- ap-northeast-3
288-
- ap-south-1
289-
- ap-southeast-1
290-
- ap-southeast-2
291-
- ca-central-1
292-
- eu-central-1
293-
- eu-north-1
294-
- eu-west-1
295-
- eu-west-2
296-
- eu-west-3
297-
- me-central-1
298-
- sa-east-1
299-
- us-east-1
300-
- us-east-2
301-
- us-west-1
302-
- us-west-2
343+
region: [ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-southeast-1, ap-southeast-2, ca-central-1, eu-central-1, eu-north-1, eu-west-1, eu-west-2, eu-west-3, me-central-1, sa-east-1, us-east-1, us-east-2, us-west-1, us-west-2]
303344
steps:
304345
- uses: actions/checkout@v4
305346
- uses: aws-actions/configure-aws-credentials@v4
@@ -308,7 +349,7 @@ jobs:
308349
aws-region: ${{ matrix.region }}
309350
- uses: jdx/mise-action@v3
310351
with:
311-
version: 2025.12.10
352+
version: ${{ env.MISE_VERSION }}
312353
experimental: true
313354
env:
314355
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -327,3 +368,47 @@ jobs:
327368
--region ${{ matrix.region }} ${{ env.COMMON_EXCLUDES }} \
328369
--exclude-resource-type eip \
329370
--delete-unaliased-kms-keys --log-level info
371+
372+
sandbox_notify:
373+
name: "Sandbox: Notify"
374+
runs-on: ubuntu-latest
375+
if: |
376+
always() && (
377+
github.event_name == 'workflow_dispatch' && (inputs.account == 'sandbox' || inputs.account == '') ||
378+
github.event_name == 'schedule' && github.event.schedule == '0 0 * * *'
379+
)
380+
needs: [sandbox_global, sandbox_regional]
381+
steps:
382+
- uses: aws-actions/configure-aws-credentials@v4
383+
with:
384+
role-to-assume: arn:aws:iam::087285199408:role/cloud-nuke-gha
385+
aws-region: us-east-1
386+
- name: Send Slack notification
387+
run: |
388+
WEBHOOK_URL=$(aws secretsmanager get-secret-value \
389+
--secret-id cloud-nuke/slack-webhook \
390+
--query SecretString --output text)
391+
392+
if [ "${{ needs.sandbox_global.result }}" == "success" ] && \
393+
[ "${{ needs.sandbox_regional.result }}" == "success" ]; then
394+
STATUS="✅ Success"
395+
COLOR="good"
396+
else
397+
STATUS="❌ Failed"
398+
COLOR="danger"
399+
fi
400+
401+
curl -sS -X POST "$WEBHOOK_URL" -H "Content-Type: application/json" -d @- <<EOF
402+
{
403+
"attachments": [{
404+
"color": "${COLOR}",
405+
"blocks": [{
406+
"type": "section",
407+
"text": {
408+
"type": "mrkdwn",
409+
"text": "*Sandbox Nuke*: ${STATUS}\nGlobal: ${{ needs.sandbox_global.result }} | Regional: ${{ needs.sandbox_regional.result }}\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
410+
}
411+
}]
412+
}]
413+
}
414+
EOF

0 commit comments

Comments
 (0)