{"id":28583739,"url":"https://github.com/richlamdev/aws-dependabot-slack-team-reporter","last_synced_at":"2025-06-11T05:39:03.641Z","repository":{"id":297313571,"uuid":"995854244","full_name":"richlamdev/aws-dependabot-slack-team-reporter","owner":"richlamdev","description":null,"archived":false,"fork":false,"pushed_at":"2025-06-04T22:08:58.000Z","size":10,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-06-05T02:58:39.818Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/richlamdev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-06-04T05:30:59.000Z","updated_at":"2025-06-04T22:09:00.000Z","dependencies_parsed_at":"2025-06-09T08:16:50.834Z","dependency_job_id":null,"html_url":"https://github.com/richlamdev/aws-dependabot-slack-team-reporter","commit_stats":null,"previous_names":["richlamdev/aws-dependabot-slack-team-reporter"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/richlamdev%2Faws-dependabot-slack-team-reporter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/richlamdev%2Faws-dependabot-slack-team-reporter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/richlamdev%2Faws-dependabot-slack-team-reporter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/richlamdev%2Faws-dependabot-slack-team-reporter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/richlamdev","download_url":"https://codeload.github.com/richlamdev/aws-dependabot-slack-team-reporter/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/richlamdev%2Faws-dependabot-slack-team-reporter/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259210026,"owners_count":22822290,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-11T05:39:00.467Z","updated_at":"2025-06-11T05:39:03.630Z","avatar_url":"https://github.com/richlamdev.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# AWS Dependabot Slack Team Reporter\n\n## 🧩 Overview\n\nThis setup deploys a Lambda that performs the following tasks:\n\n1. Utilizes a GitHub App for authentication\n2. Reads repositories to parse `.github/CODEOWNERS`\n    -in the absence of CODEOWNERS file, the `security team` becaomes the default\n    (this is to have the security team track down and assign appropriate ownership)\n3. Obtains a list of non-archived repositories\n4. Fetches Dependabot alerts for each repository\n5. Posts alerts to Slack channels based on team ownership\n\n---\n\n## 📦 Design\n\nThis architecture is templated for two lambda deployments that are nearly identical.  Why?\n\n1. Allows for convenient deployment in the same AWS account, without conflicts of resource names\n2. Enables deploying two lambdas for different GitHub organizations,\n\n---\n\n## 🚀 Deployment\n\n### Prerequisites\n\n- AWS CLI and [AWS SAM CLI](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html)\n- GitHub App credentials stored in **AWS Secrets Manager**\n  Preferably all Github repositories have the ./github/CODEOWNERS file populated\n- Slack Webhook URLs mapped to team names\n\n***Note**: The GitHub App must have the `metadata: read`, `contents: read` and `dependabot: read` permission\n\n### 1. Clone the repo\n\n```\ngit clone https://github.com/richlamdev/aws-dependabot-slack-team-reporter.git\ncd aws-dependabot-slack-team-reporter\n```\n\n### 2. Set environment variables\n\nSet the following Parameter variable in the template file, or change it when prompted during guided deployment\n\n- `GitHubOrg` – Your GitHub organization name\n\nSet the following values in AWS Secrets manager:\n\n- `GITHUB_APP_ID`   – GitHub App ID\n- `GITHUB_APP_PEM`  – GitHub App PEM key\n- `TEAM_TO_CHANNEL` – JSON map of team slugs to Slack webhook URLs\n\nAfter setting the above values in AWS Secrets manager, replace the placeholder ARNs in the template.yaml file\n\nExample `SLACK_TEAM_MAPPING`:\n\n```json\n{\n  \"frontend\": \"https://hooks.slack.com/services/XXX/YYY/ZZZ\",\n  \"backend\": \"https://hooks.slack.com/services/AAA/BBB/CCC\",\n  \"security\": \"https://hooks.slack.com/services/DEF/GHI/JKL\"\n}\n```\nWhile it is possible to have the GITHUB_APP_ID and GITHUB_APP_SECRET_NAME in the same secret as a JSON blob,\nit involves additional steps to format the PEM correctly for storage as well as parse the PEM key accordingly\nduring retrieval.  By keeping it a separate secret it's a straight forward copy and paste to store the key,\nand likewise keeps the retrieval simple.\n\n### 3. Deploy with AWS SAM\n\nAuthenticate to AWS via CLI.\n\nEnter the appropriate directory for deployment\n\n```\ncd deployments/staging\n```\n\nor\n\n```\ncd deployments/production\n```\n\nThen execute the following commands:\n```\nsam build\nsam deploy --guided\n```\n\nFollow the prompts to configure the deployment stack, region, and parameters.\n\nOptionally, monitor the CloudFormation stack in the AWS Management Console.\nWhen the stack is complete, you can find the Lambda function ARN in the Outputs section.\nVerify the environment variable, the Lambda role, and Eventbridge schedule and test the lambda.\nCheck the CloudWatch logs for errors and verify any updates to the Slack channels.\n\n---\n\n## 🛠️ Configuration\n\nThe Lambda uses the following AWS resources:\n\n- **Secrets Manager** for storing GitHub App private key\n- **EventBridge** cron for scheduling scans\n- **Policies** with minimal required permissions\n- **Tags** to indicate ownership and deployment or resources. (Who doesn't tag their resources? /sarcasm)\n\nGitHub App must have these permissions:\n\n- `metadata: read`\n- `contents: read`\n- `dependabot: read`\n\n---\n\n## 🧪 Testing\n\nYou can test the Lambda functions locally using the SAM CLI (docker desktop or docker engine must be running):\n\n```\nsam build \u0026\u0026 sam local invoke DependabotFunction\n```\n\n---\n\n## 📁 Project Structure\n\n```\n.\n│\n├── deployments/\n│   │\n│   ├── production/\n│   │    └── template.yaml            # Production account template\n│   │\n│   └── staging/\n│        └── template.yaml            # Staging account template\n│\n└── src/\n    ├── dependabot-slack-team.py      # Entrypoint for scheduled Lambda\n    └── requirements.txt              # Python dependencies\n```\n\n---\n\n## 👥 Contributing\n\nPull requests are welcome! For major changes, please open an issue first to discuss the proposal.\n\n---\n\n## 🛡 License\n\n[MIT](LICENSE)\n\n---\n\n## 📬 Maintainer\n\nCreated by [@richlamdev](https://github.com/richlamdev)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frichlamdev%2Faws-dependabot-slack-team-reporter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frichlamdev%2Faws-dependabot-slack-team-reporter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frichlamdev%2Faws-dependabot-slack-team-reporter/lists"}