fix: use composite actions for slack

.github/actions/post/action.yml

@@ -0,0 +1,77 @@
+name: Entur/Slack/Post
+description: Post a message to Slack
+
+inputs:
+  channel_id:
+    description: "Slack channel ID"
+    required: true
+  message:
+    description: "Plain text message"
+    required: false
+    default: "Default slack message"
+  blocks:
+    description: "Slack Block Kit JSON blocks"
+    required: false
+  thread_ts:
+    description: "Post as threaded reply to this message timestamp"
+    required: false
+  token:
+    description: "Slack bot token"
+    required: true
+
+outputs:
+  message_ts:
+    description: "Slack message timestamp (unique message ID)"
+    value: ${{ steps.capture-ts.outputs.message_ts }}
+
+runs:
+  using: composite
+  steps:
+    - id: set-env
+      shell: bash
+      env:
+        INPUT_CHANNEL: ${{ inputs.channel_id }}
+        INPUT_MESSAGE: ${{ inputs.message }}
+        INPUT_BLOCKS: ${{ inputs.blocks }}
+        INPUT_THREAD_TS: ${{ inputs.thread_ts }}
+      run: |
+        echo "GHA_SLACK_POST_CHANNEL=$INPUT_CHANNEL" >> $GITHUB_ENV
+        echo 'GHA_SLACK_POST_MESSAGE<<GHA_SLACK_EOM_DELIMITER' >> $GITHUB_ENV
+        echo "$INPUT_MESSAGE" >> $GITHUB_ENV
+        echo 'GHA_SLACK_EOM_DELIMITER' >> $GITHUB_ENV
+        if [ -n "$INPUT_BLOCKS" ]; then
+          echo "$INPUT_BLOCKS" | jq . > /dev/null 2>&1 || { echo "::error::blocks input is not valid JSON"; exit 1; }
+        fi
+        echo 'GHA_SLACK_POST_BLOCKS<<GHA_SLACK_EOB_DELIMITER' >> $GITHUB_ENV
+        echo "$INPUT_BLOCKS" >> $GITHUB_ENV
+        echo 'GHA_SLACK_EOB_DELIMITER' >> $GITHUB_ENV
+        echo "GHA_SLACK_POST_THREAD_TS=$INPUT_THREAD_TS" >> $GITHUB_ENV
+    - id: build-payload
+      shell: bash
+      env:
+        CHANNEL: ${{ env.GHA_SLACK_POST_CHANNEL }}
+        TEXT: ${{ env.GHA_SLACK_POST_MESSAGE }}
+        BLOCKS: ${{ env.GHA_SLACK_POST_BLOCKS }}
+        THREAD_TS: ${{ env.GHA_SLACK_POST_THREAD_TS }}
+      run: |
+        PAYLOAD=$(jq -n \
+          --arg channel "$CHANNEL" \
+          --arg text "$TEXT" \
+          --arg thread_ts "$THREAD_TS" \
+          '{channel: $channel, text: $text} + (if $thread_ts != "" then {thread_ts: $thread_ts} else {} end)')
+        if [ -n "$BLOCKS" ]; then
+          PAYLOAD=$(echo "$PAYLOAD" | jq --argjson blocks "$BLOCKS" '. + {blocks: $blocks}')
+        fi
+        echo "payload<<GHA_SLACK_PAYLOAD_DELIMITER" >> $GITHUB_OUTPUT
+        echo "$PAYLOAD" >> $GITHUB_OUTPUT
+        echo "GHA_SLACK_PAYLOAD_DELIMITER" >> $GITHUB_OUTPUT
+    - id: slack-post
+      uses: slackapi/slack-github-action@v3.0.1
+      with:
+        method: chat.postMessage
+        token: ${{ inputs.token }}
+        payload: ${{ steps.build-payload.outputs.payload }}
+    - id: capture-ts
+      shell: bash
+      run: |
+        echo "message_ts=${{ steps.slack-post.outputs.ts }}" >> $GITHUB_OUTPUT

.github/actions/react/action.yml

@@ -0,0 +1,30 @@
+name: Entur/Slack/React
+description: Add a reaction to a Slack message
+
+inputs:
+  channel_id:
+    description: "Slack channel ID"
+    required: true
+  message_ts:
+    description: "Message timestamp to react to"
+    required: true
+  emoji:
+    description: "Emoji name without colons"
+    required: true
+  token:
+    description: "Slack bot token"
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - id: slack-react
+      uses: slackapi/slack-github-action@v3.0.1
+      with:
+        method: reactions.add
+        token: ${{ inputs.token }}
+        errors: true
+        payload: |
+          channel: "${{ inputs.channel_id }}"
+          timestamp: "${{ inputs.message_ts }}"
+          name: "${{ inputs.emoji }}"

.github/workflows/ci.yml → .github/workflows/ci.yaml

@@ -1,12 +1,10 @@
 name: Entur/Slack/CI
 
 on:
-  push:
-    branches:
-      - main
+  workflow_call:
   pull_request:
-  pull_request_review:
-    types: [submitted]
+    branches: [main]
+    types: [opened, synchronize, reopened, edited] # on PR edit, rerun
 
 jobs:
   verify-pr:
@@ -15,15 +13,15 @@ jobs:
     uses: entur/gha-meta/.github/workflows/verify-pr.yml@v1
 
   test-post-message:
-    if: github.actor != 'dependabot[bot]' || (github.event_name == 'pull_request_review' && github.event.review.state == 'approved')
+    if: github.actor != 'dependabot[bot]'
     uses: ./.github/workflows/post.yml
     with:
       channel_id: "C01AVRY6Q23" # notify-plattform
       message: "gha-slack CI: Test to send simple plain text message\n with line break using gha-slack/post!"
     secrets: inherit
 
   test-post-message-with-blocks:
-    if: github.actor != 'dependabot[bot]' || (github.event_name == 'pull_request_review' && github.event.review.state == 'approved')
+    if: github.actor != 'dependabot[bot]'
     uses: ./.github/workflows/post.yml
     with:
       channel_id: "C01AVRY6Q23" # notify-plattform

.github/workflows/dependabot-pr.yaml

@@ -0,0 +1,20 @@
+# Dependabot pull request workflow
+#
+# Dependabot PRs do not receive repository secrets by default.
+# This workflow adds an approval gate so secrets are only exposed after a human has reviewed and approved the PR.
+# You can use workflow_dispatch to test the workflow before enabling the approval flow.
+
+name: on-pull_request_review-submitted
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    if: github.event.review.state == 'approved' && github.event.pull_request.user.login == 'dependabot[bot]'
+    uses: ./.github/workflows/ci.yaml
+    secrets: inherit

.github/workflows/post.yml

@@ -35,53 +35,14 @@ jobs:
     permissions:
       contents: read
     outputs:
-      message_ts: ${{ steps.capture-ts.outputs.message_ts }}
+      message_ts: ${{ steps.post.outputs.message_ts }}
     steps:
-      - id: set-env
-        shell: bash
-        env:
-          INPUT_CHANNEL: ${{ inputs.channel_id }}
-          INPUT_MESSAGE: ${{ inputs.message }}
-          INPUT_BLOCKS: ${{ inputs.blocks }}
-          INPUT_THREAD_TS: ${{ inputs.thread_ts }}
-        run: |
-          echo "GHA_SLACK_POST_CHANNEL=$INPUT_CHANNEL" >> $GITHUB_ENV
-          echo 'GHA_SLACK_POST_MESSAGE<<GHA_SLACK_EOM_DELIMITER' >> $GITHUB_ENV
-          echo "$INPUT_MESSAGE" >> $GITHUB_ENV
-          echo 'GHA_SLACK_EOM_DELIMITER' >> $GITHUB_ENV
-          if [ -n "$INPUT_BLOCKS" ]; then
-            echo "$INPUT_BLOCKS" | jq . > /dev/null 2>&1 || { echo "::error::blocks input is not valid JSON"; exit 1; }
-          fi
-          echo 'GHA_SLACK_POST_BLOCKS<<GHA_SLACK_EOB_DELIMITER' >> $GITHUB_ENV
-          echo "$INPUT_BLOCKS" >> $GITHUB_ENV
-          echo 'GHA_SLACK_EOB_DELIMITER' >> $GITHUB_ENV
-          echo "GHA_SLACK_POST_THREAD_TS=$INPUT_THREAD_TS" >> $GITHUB_ENV
-      - id: build-payload
-        shell: bash
-        env:
-          CHANNEL: ${{ env.GHA_SLACK_POST_CHANNEL }}
-          TEXT: ${{ env.GHA_SLACK_POST_MESSAGE }}
-          BLOCKS: ${{ env.GHA_SLACK_POST_BLOCKS }}
-          THREAD_TS: ${{ env.GHA_SLACK_POST_THREAD_TS }}
-        run: |
-          PAYLOAD=$(jq -n \
-            --arg channel "$CHANNEL" \
-            --arg text "$TEXT" \
-            --arg thread_ts "$THREAD_TS" \
-            '{channel: $channel, text: $text} + (if $thread_ts != "" then {thread_ts: $thread_ts} else {} end)')
-          if [ -n "$BLOCKS" ]; then
-            PAYLOAD=$(echo "$PAYLOAD" | jq --argjson blocks "$BLOCKS" '. + {blocks: $blocks}')
-          fi
-          echo "payload<<GHA_SLACK_PAYLOAD_DELIMITER" >> $GITHUB_OUTPUT
-          echo "$PAYLOAD" >> $GITHUB_OUTPUT
-          echo "GHA_SLACK_PAYLOAD_DELIMITER" >> $GITHUB_OUTPUT
-      - id: slack-post
-        uses: slackapi/slack-github-action@v3.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - id: post
+        uses: ./.github/actions/post
         with:
-          method: chat.postMessage
+          channel_id: ${{ inputs.channel_id }}
+          message: ${{ inputs.message }}
+          blocks: ${{ inputs.blocks }}
+          thread_ts: ${{ inputs.thread_ts }}
           token: ${{ secrets.SLACK_BOT_TOKEN }}
-          payload: ${{ steps.build-payload.outputs.payload }}
-      - id: capture-ts
-        shell: bash
-        run: |
-          echo "message_ts=${{ steps.slack-post.outputs.ts }}" >> $GITHUB_OUTPUT

.github/workflows/react.yml

@@ -26,13 +26,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - id: slack-react
-        uses: slackapi/slack-github-action@v3.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/react
         with:
-          method: reactions.add
+          channel_id: ${{ inputs.channel_id }}
+          message_ts: ${{ inputs.message_ts }}
+          emoji: ${{ inputs.emoji }}
           token: ${{ secrets.SLACK_BOT_TOKEN }}
-          errors: true
-          payload: |
-            channel: "${{ inputs.channel_id }}"
-            timestamp: "${{ inputs.message_ts }}"
-            name: "${{ inputs.emoji }}"

README-react.md

@@ -54,19 +54,17 @@ jobs:
 
 <!-- AUTO-DOC-INPUT:START - Do not remove or modify this section -->
 
-| INPUT                                                                         | TYPE   | REQUIRED | DEFAULT | DESCRIPTION                                                                                                                                                                                                                                                                                      |
-| ----------------------------------------------------------------------------- | ------ | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| <a name="input_channel_id"></a>[channel_id](#input_channel_id)                | string | true     |         | Slack channel ID where the <br>message was posted                                                                                                                                                                                                                                                |
-| <a name="input_emoji"></a>[emoji](#input_emoji)                               | string | true     |         | Emoji name to react with (without colons). Common examples: <br>- `white_check_mark` ✅ success / done <br>- `x` ❌ failure <br>- `rocket` 🚀 deployment / release <br>- `eyes` 👀 reviewing / taking a look <br>- `tada` 🎉 celebration <br>- `warning` ⚠️ warning <br>- `thumbsup` 👍 approval |
-| <a name="input_message_ts"></a>[message_ts](#input_message_ts)                | string | true     |         | Slack message timestamp (unique message ID) to <br>react to                                                                                                                                                                                                                                      |
-| <a name="input_timeout_minutes"></a>[timeout_minutes](#input_timeout_minutes) | number | false    | `5`     | Job timeout in minutes                                                                                                                                                                                                                                                                           |
+|                                     INPUT                                     |  TYPE  | REQUIRED | DEFAULT |                         DESCRIPTION                          |
+|-------------------------------------------------------------------------------|--------|----------|---------|--------------------------------------------------------------|
+|        <a name="input_channel_id"></a>[channel_id](#input_channel_id)         | string |   true   |         |      Slack channel ID where the <br>message was posted       |
+|                <a name="input_emoji"></a>[emoji](#input_emoji)                | string |   true   |         |        Emoji name to react with <br>(without colons)         |
+|        <a name="input_message_ts"></a>[message_ts](#input_message_ts)         | string |   true   |         | Slack message timestamp (unique message ID) to <br>react to  |
+| <a name="input_timeout_minutes"></a>[timeout_minutes](#input_timeout_minutes) | number |  false   |   `5`   |                    Job timeout in minutes                    |
 
 <!-- AUTO-DOC-INPUT:END -->
 
 ## Outputs
 
 <!-- AUTO-DOC-OUTPUT:START - Do not remove or modify this section -->
-
 No outputs.
-
 <!-- AUTO-DOC-OUTPUT:END -->