feat: Add destination - Microsoft Teams (channels)

.github/workflows/ci.yml

@@ -26,6 +26,7 @@ jobs:
         uses: ./
         with:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          # microsoft_teams_webhook: ${{ secrets.MICROSOFT_TEAMS_WEBHOOK }}
           # slack_webhook: ${{ secrets.SLACK_WEBHOOK }}
           # pager_duty_integration_key: ${{ secrets.PAGER_DUTY_INTEGRATION_KEY }}
           # zenduty_api_key: ${{ secrets.ZENDUTY_API_KEY }}

README.md

@@ -4,6 +4,7 @@
 
 A [GitHub action](https://github.com/features/actions) that sends Dependabot Vulnerability Alerts to multiple sources:
 
+- Microsoft Teams
 - Slack
 - PagerDuty
 - Zenduty

action.yml

@@ -4,6 +4,8 @@ author: '@kunalnagar'
 inputs:
   token:
     description: 'GitHub Personal Access Token'
+  microsoft_teams_webhook:
+    description: 'Microsoft Teams Channel Webhook URL. More info: https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook'
   slack_webhook:
     description: 'Slack Webhook URL. More info: https://api.slack.com/messaging/webhooks'
   pager_duty_integration_key:

package.json

@@ -48,6 +48,7 @@
     "@actions/github": "5.0.0",
     "@pagerduty/pdjs": "2.2.4",
     "@slack/webhook": "6.0.0",
+    "adaptivecards": "^2.10.0",
     "node-fetch": "2.6.6"
   },
   "devDependencies": {

src/destinations/index.ts

@@ -1,3 +1,4 @@
 export * from './slack'
 export * from './pager-duty'
 export * from './zenduty'
+export * from './microsoft-teams'

src/destinations/microsoft-teams.ts

@@ -0,0 +1,96 @@
+/* eslint-disable i18n-text/no-en */
+import {
+  Row,
+  createAdaptiveCard,
+  createColumn,
+  createContainer,
+  createLinkButton,
+  createRow,
+  createTextBlock,
+  request,
+} from '../utils'
+import { ACTION_SHORT_SUMMARY } from '../constants'
+import { Alert } from '../entities'
+
+const createTableRow = (key: string, value: string): Row => {
+  const row = createRow()
+  const keyColumn = createColumn()
+  keyColumn.addItem(createTextBlock(key, true))
+  row.addColumn(keyColumn)
+  const valueColumn = createColumn()
+  valueColumn.addItem(createTextBlock(value))
+  row.addColumn(valueColumn)
+  return row
+}
+
+const createTableButtonRow = (url: string): Row => {
+  const row = createRow()
+  const keyColumn = createColumn()
+  keyColumn.addItem(createTextBlock('Advisory URL', true))
+  row.addColumn(keyColumn)
+  const urlColumn = createColumn()
+  urlColumn.addItem(createLinkButton('View Advisory', url))
+  row.addColumn(urlColumn)
+  return row
+}
+
+export const sendAlertsToMicrosoftTeams = async (
+  webhookUrl: string,
+  alerts: Alert[],
+): Promise<void> => {
+  const alertCount = alerts.length
+  const repositoryOwner = alerts[0].repository.owner
+  const repositoryName = alerts[0].repository.name
+
+  const adaptiveCard = createAdaptiveCard()
+
+  adaptiveCard.addItem(createTextBlock(ACTION_SHORT_SUMMARY))
+
+  adaptiveCard.addItem(
+    createTextBlock(
+      `You have ${alertCount} vulnerabilities in ${repositoryOwner}/${repositoryName}`,
+    ),
+  )
+
+  for (const alert of alerts) {
+    const container = createContainer(true, true)
+    container.addItem(createTableRow('Package Name', alert.packageName))
+    container.addItem(
+      createTableRow(
+        'Vulnerability Version Range',
+        alert.vulnerability?.vulnerableVersionRange || '',
+      ),
+    )
+    container.addItem(
+      createTableRow(
+        'Patched Version',
+        alert.vulnerability?.firstPatchedVersion || '',
+      ),
+    )
+    container.addItem(
+      createTableRow('Severity', alert.advisory?.severity || ''),
+    )
+    container.addItem(createTableRow('Summary', alert.advisory?.summary || ''))
+    container.addItem(createTableButtonRow(alert.advisory?.url || ''))
+    adaptiveCard.addItem(container)
+  }
+
+  const body = {
+    type: 'message',
+    attachments: [
+      {
+        contentType: 'application/vnd.microsoft.card.adaptive',
+        contentUrl: null,
+        content: adaptiveCard.toJSON(),
+      },
+    ],
+  }
+
+  await request(webhookUrl, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify(body),
+  })
+}

src/main.ts

@@ -1,5 +1,6 @@
 import { getInput, setFailed } from '@actions/core'
 import {
+  sendAlertsToMicrosoftTeams,
   sendAlertsToPagerDuty,
   sendAlertsToSlack,
   sendAlertsToZenduty,
@@ -11,6 +12,7 @@ import { fetchAlerts } from './fetch-alerts'
 async function run(): Promise<void> {
   try {
     const token = getInput('token')
+    const microsoftTeamsWebhookUrl = getInput('microsoft_teams_webhook')
     const slackWebhookUrl = getInput('slack_webhook')
     const pagerDutyIntegrationKey = getInput('pager_duty_integration_key')
     const zenDutyApiKey = getInput('zenduty_api_key')
@@ -21,6 +23,9 @@ async function run(): Promise<void> {
     const repo = context.repo.repo
     const alerts = await fetchAlerts(token, repo, owner, count)
     if (alerts.length > 0) {
+      if (microsoftTeamsWebhookUrl) {
+        await sendAlertsToMicrosoftTeams(microsoftTeamsWebhookUrl, alerts)
+      }
       if (slackWebhookUrl) {
         if (!validateSlackWebhookUrl(slackWebhookUrl)) {
           setFailed(new Error('Invalid Slack Webhook URL'))