GitHub Advisory Database から脆弱性情報を Slack に通知するシステムを作ったら、チームの雰囲気が少し変わった

./
├── package-lock.json
├── package.json
├── src
│   ├── fetcher
│   │   └── index.ts … GitHub Advisory Database の情報を取得する処理
│   ├── slack
│   │   └── index.ts … Slack に投稿する処理
│   └── index.ts … エントリーポイント
└── tsconfig.json

import type { Endpoints } from '@octokit/types';
import type { Octokit } from 'octokit';

type ParamsType = Required<
  Pick<
    Endpoints['GET /advisories']['parameters'],
    'ecosystem' | 'per_page' | 'updated'
  >
>;

export const createFetcher = ({
  octokit,
  params
}: {
  octokit: Octokit;
  params: ParamsType;
}) => {
  return () => {
    return octokit.request('GET /advisories', {
      headers: {
        'X-GitHub-Api-Version': '2022-11-28'
      },
      ecosystem: params.ecosystem,
      per_page: params.per_page,
      updated: params.updated
    });
  };
};

type ParamsType = Required<
  Pick<
    Endpoints['GET /advisories']['parameters'],
    'ecosystem' | 'per_page' | 'updated'
  >
>;

/**
 * 実際に実行すると、こんな感じです
 */
const fetcher = createFetcher({
  octokit,
  params: {
    ecosystem: 'npm',                                    // 必須指定
    per_page: 100,                                       // 必須指定
    updated: `>=${queryDate.toISOString().slice(0, 10)}` // 必須指定
  }
});

const response = await fetcher();

import type { components } from '@octokit/openapi-types';

const SEVERITY_EMOJI: Record<components['schemas']['global-advisory']['severity'], string> = {
  critical: '🔴',
  high: '🟠',
  medium: '🟡',
  low: '🟢',
  unknown: '⚠️'
} as const;

export const createPost = ({
  vulnerabilities,
  postDateText
}: {
  vulnerabilities: components['schemas']['global-advisory'][];
  postDateText: string;
}) => {
  const blocks: SlackBlock[] = [
    {
      type: 'header',
      text: {
        type: 'plain_text',
        text: `🚨 NPM エコシステム 脆弱性アラート (${vulnerabilities.length}件)`,
        emoji: true
      }
    },
    {
      type: 'section',
      text: {
        type: 'mrkdwn',
        text: `${postDateText}付けで新たに ${vulnerabilities.length} 件の High, Critical の脆弱性情報の更新がありました。`
      }
    },
    {
      type: 'divider'
    }
  ];

  // 脆弱性の情報をまとめる
  vulnerabilities.forEach((item, index) => {
    if (!(item.severity === 'high' || item.severity === 'critical')) return;

    const emoji = SEVERITY_EMOJI[item.severity] || '⚠️';
    const vulnerablePackagesText = (item.vulnerabilities ?? [])
      .map((pkg) => {
        const ecosystem = pkg.package?.ecosystem ?? '-';
        const name = pkg.package?.name ?? '-';

        return (
          `- エコシステム: ${ecosystem}\n` + `- package 名: ${name}\n`
        );
      })
      .join('\n');
    blocks.push({
      type: 'section',
      text: {
        type: 'mrkdwn',
        text:
          `*GHSA ID: ${item.ghsa_id} - ${emoji} ${item.severity}*\n` +
          `*Package 概要:*\n` +
          `${vulnerablePackagesText}\n` +
          `*サマリー:* ${item.summary ?? '---'}\n` +
          `<${`https://github.com/advisories/${item.ghsa_id}` || item.repository_advisory_url}|詳細を見る>`
      }
    });

    if (index < vulnerabilities.length - 1 && (index + 1) % 5 === 0) {
      blocks.push({ type: 'divider' });
    }
  });

  return blocks;
};

import { type RequestOptions, request } from 'node:https';

interface SlackBlock {
  type: string;
  text?: {
    type: string;
    text: string;
    emoji?: boolean;
  };
}

export const postToSlack = ({
  slackWebhookUrl,
  blocks
}: {
  slackWebhookUrl: string;
  blocks: SlackBlock[];
}) => {
  return new Promise((resolve, reject) => {
    const url = new URL(slackWebhookUrl);

    const payload = {
      text: 'Critical/High の脆弱性通知',
      blocks
    };
    const data = JSON.stringify(payload);

    const options: RequestOptions = {
      protocol: url.protocol,
      hostname: url.hostname,
      port: url.port ? Number(url.port) : undefined,
      path: url.pathname + url.search,
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Content-Length': Buffer.byteLength(data)
      }
    };

    const req = request(options, (res) => {
      let body = '';
      res.setEncoding('utf8');
      res.on('data', (chunk) => {
        body += chunk;
      });
      res.on('end', () => {
        if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
          resolve(true);
          return;
        }

        reject(new Error(`Slack API error: ${res.statusCode} ${body}`));
      });
    });

    req.on('error', reject);
    req.write(data);
    req.end();
  });
};