Notify #gh-wallet-eng when a new issue is opened by JakeUrban · Pull Request #2951 · stellar/freighter

JakeUrban · 2026-08-10T22:36:47Z

What

Adds .github/workflows/notifySlackNewIssue.yml. Whenever an issue is opened in this repo, it posts a message to #gh-wallet-eng with the issue number, title, author, and a link.

Triggers on opened only — not close, reopen, or edit — and notifies for every new issue regardless of who filed it. A companion workflow is added in stellar/freighter-mobile (stellar/freighter-mobile#972).

Why

New issues should surface in Slack without anyone having to watch GitHub notifications.

This is a workflow rather than the GitHub Slack app's /github subscribe <repo> issues because that feature notifies on opened, closed, and reopened events with no filtering by event type or author. Under it, triaging an issue re-notifies the channel.

How it works

Posts via slackapi/slack-github-action, pinned by commit SHA. It is a Node action, so the pin covers the code that executes.
The payload is built with jq --arg and passed via payload-file-path, so no value is interpolated into YAML or JSON syntax.
The issue title is untrusted input, so it goes into a Block Kit plain_text object. Slack does not parse that as mrkdwn, so link and mention syntax in a title renders literally rather than taking effect. The fallback text, which is mrkdwn-parsed, escapes &, <, and >.
permissions: {} — the job does not use the repository token.

Requirements

A SLACK_WEBHOOK_GH_ISSUES secret holding an incoming webhook bound to #gh-wallet-eng. This must exist before merge or the job fails. It is deliberately separate from the SLACK_WEBHOOK used by the release workflows, so a workflow driven by untrusted input does not share that webhook.

Verification

The payload build and Slack delivery were exercised against the real secret on a branch build, using the same jq program and action pin as this workflow. The message posted to #gh-wallet-eng correctly, with markup in the title rendered as literal text rather than an active link.

The issues: [opened] trigger itself is not exercised until this reaches the default branch, since GitHub runs event-triggered workflows only from there.

Limitations

Every new issue notifies, including issues opened by the team.

Posts to #gh-wallet-eng whenever an issue is opened. Fires on `opened` only, which the GitHub Slack app's `issues` subscription cannot express (it always covers opened + closed + reopened). Notifies for every new issue for now; the workflow comments document the `author_association` filter to add if the channel becomes too noisy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ka8rvrCJEKLroVskzayvo

A Slack-app incoming webhook is bound to the channel it was installed against and ignores the channel in the payload, so SLACK_CHANNEL alone cannot redirect release-workflow traffic to #gh-wallet-eng. Point this workflow at its own SLACK_WEBHOOK_GH_ISSUES secret, holding a webhook bound to #gh-wallet-eng, leaving SLACK_WEBHOOK untouched for the release workflows. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ka8rvrCJEKLroVskzayvo

github-actions · 2026-08-10T22:39:11Z

PR Preview build is ready: https://github.com/stellar/freighter/releases/tag/untagged-c974b109609ed4705559 (SDF collaborators only — install instructions in the release description)

Copilot

Pull request overview

Adds Slack notifications to #gh-wallet-eng whenever an issue is opened.

Changes:

Adds an issue-opened GitHub Actions workflow.
Sends issue details through a dedicated Slack webhook.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

JakeUrban · 2026-08-10T23:09:49Z

+    steps:
+      - name: Slack Notification
+        uses: rtCamp/action-slack-notify@07cbdbfd6c6190970778d8f98f11d073b2932aae #v2.3.3
+        env:
+          MSG_MINIMAL: true
+          SLACK_CHANNEL: gh-wallet-eng
+          SLACK_COLOR: "#70E1C8"
+          SLACK_ICON: https://github.com/stellar/freighter/blob/master/docs/static/images/logo.png?size=48
+          SLACK_MESSAGE:
+            "<${{ github.event.issue.html_url }}|#${{ github.event.issue.number
+            }}: ${{ github.event.issue.title }}> — opened by ${{
+            github.event.issue.user.login }}"


Valid finding — fixed in ea37105.

The step no longer builds a mrkdwn string at all. The title now goes into a Block Kit plain_text object, which Slack does not parse as mrkdwn, so link and mention syntax renders literally rather than being interpreted. The payload is built with jq --arg and handed over via payload-file-path, so untrusted text is never interpolated into YAML or JSON syntax either.

The plain_text title is deliberately not entity-escaped, since plain_text is not mrkdwn and < would render as the literal characters. The escaping is applied to the top-level text fallback instead, which is used for push notifications and is parsed — & first, so the entities introduced aren't re-escaped.

Verified against a hostile title (pwn> <!channel> <https://evil.example|Reset your Freighter key> & "quotes"): output is valid JSON, the fallback is correctly escaped, and the plain_text block carries the title verbatim.

Generated by Claude Code

Addresses review feedback on the notification step. Issue titles are attacker-controlled, and the previous SLACK_MESSAGE put the title inside Slack's <url|label> syntax unescaped. A title could terminate the link and inject an arbitrary hyperlink into the channel. Switch to slackapi/slack-github-action and put the title in a Block Kit plain_text object, which Slack does not parse as mrkdwn, so link and mention syntax renders literally. The payload is built with `jq --arg` and passed as a file, so untrusted text is never interpolated into YAML or JSON syntax. The top-level fallback text, which IS parsed as mrkdwn, escapes &, < and > instead. This also closes a supply-chain gap: rtCamp's action is a composite that runs docker://ghcr.io/rtcamp/action-slack-notify at a mutable tag, so the SHA pin did not pin the executed code. slackapi's action is node24, so the SHA pin covers what actually runs. Drop the unused repository token permissions while here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ka8rvrCJEKLroVskzayvo

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ka8rvrCJEKLroVskzayvo

…d3wuc6

claude added 2 commits August 10, 2026 22:13

Copilot AI balanced review requested due to automatic review settings August 10, 2026 22:36

JakeUrban mentioned this pull request Aug 10, 2026

Notify #gh-wallet-eng when a new issue is opened stellar/freighter-mobile#972

Merged

15 tasks

Copilot started reviewing on behalf of JakeUrban August 10, 2026 22:37 View session

Copilot AI reviewed Aug 10, 2026

View reviewed changes

claude added 2 commits August 10, 2026 23:09

Trim workflow comments to describe behavior only

b2a08c5

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ka8rvrCJEKLroVskzayvo

JakeUrban self-assigned this Aug 11, 2026

claude added 2 commits August 11, 2026 23:16

TEMP: verify Slack webhook end to end (delete before merge)

ff8427c

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ka8rvrCJEKLroVskzayvo

Remove temporary Slack webhook test workflow

26f0b90

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ka8rvrCJEKLroVskzayvo

aristidesstaffieri approved these changes Aug 12, 2026

View reviewed changes

Merge branch 'master' into claude/slack-external-issue-notifications-…

fab9284

…d3wuc6

JakeUrban merged commit b55fbda into master Aug 12, 2026
11 checks passed

JakeUrban deleted the claude/slack-external-issue-notifications-d3wuc6 branch August 12, 2026 16:50

github-actions Bot mentioned this pull request Aug 18, 2026

v5.45.0 #2969

Merged

Navigation Menu

Uh oh!

Notify #gh-wallet-eng when a new issue is opened - #2951

Notify #gh-wallet-eng when a new issue is opened#2951
JakeUrban merged 7 commits into
masterfrom
claude/slack-external-issue-notifications-d3wuc6

JakeUrban commented Aug 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

JakeUrban Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

JakeUrban commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

How it works

Requirements

Verification

Limitations

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

JakeUrban Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

JakeUrban commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading