Setup CodeQL Slack notifications

Author: kyle-c-simmons

.github/workflows/codeql.yml

@@ -1,10 +1,7 @@
 name: CodeQL
 
-on: 
-  workflow_dispatch:
-  schedule:
-    # Run at the end of every Monday
-    - cron: '0 0 * * 1'
+on:
+  push
 
 jobs:
   analyze:
@@ -68,3 +65,29 @@ jobs:
         uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3
         with:
           category: '/language:${{matrix.config.language}}'
+          output: sarif-output-${{ matrix.config.language }}.sarif
+      - name: Filter SARIF Results
+        run: |
+          REPO_URL="https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/"
+          jq --arg baseUrl "$REPO_URL" '.runs[].results[] |
+            {
+              ruleId: .ruleId,
+              message: .message.text,
+              url: "\($baseUrl)\(.locations[0].physicalLocation.artifactLocation.uri)#L\(.locations[0].physicalLocation.region.startLine)-L\(.locations[0].physicalLocation.region.endLine)"
+            }' sarif-output-${{ matrix.config.language }}.sarif/${{ matrix.config.language }}.sarif > filtered-${{ matrix.config.language }}.json
+      - name: Display Filtered Results
+        run: cat filtered-${{ matrix.config.language }}.json
+      - name: Send Slack Notification
+        env:
+          SEC_BOT_SLACK_WEBHOOK: ${{ secrets.SEC_BOT_SLACK_WEBHOOK }}
+        run: |
+          # Format alerts into Slack-friendly text
+          ALERTS=$(jq -r '. | "*Rule:* \(.ruleId)\n*Message:* \(.message)\n*URL:* \(.url)\n"' filtered-${{ matrix.config.language }}.json)
+
+          # Send the alerts as a Slack message
+          curl -X POST -H "Authorization: Bearer $SEC_BOT_SLACK_WEBHOOK" \
+                -H "Content-type: application/json" \
+                --data '{
+                  "channel": "#a-new-private-channel-in-this-slack-org-for-kyle-and-feroz-to-test-some-security",
+                  "text": "Code Scanning Alerts for ${{ matrix.config.language }}:\n'"${ALERTS}"'"
+                }' https://slack.com/api/chat.postMessage