Use workflow_run to send status embed to Discord

I've changed the way we send status embeds to make it work for PRs made
from forks without potentially exposing secrets. Instead of using the
initial workflows to send the embed, I've created a `workflow_run`
workflow that always runs in the context of the base repository.

And added benefit is that we don't have to add the status embed step to
two separate workflows.

3 files changed, 71 insertions, 63 deletions

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 64c272cf..b0c03139 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -75,34 +75,3 @@ jobs:
               kubernetes/sir-lancebot/deployment.yaml
           images: 'ghcr.io/python-discord/sir-lancebot:${{ steps.sha_tag.outputs.tag }}'
           kubectl-version: 'latest'
-
-      # Send an informational status embed to Discord instead of the
-      # standard embeds that Discord sends. This embed will contain
-      # more information and we can fine tune when we actually want
-      # to send an embed.
-      - name: GitHub Actions Status Embed for Discord
-        # This is the last step in the lint-build sequence, so always send
-        # an embed, regardless of success, failure or cancelled status.
-        if: always()
-        uses: SebastiaanZ/[email protected]
-        with:
-          # Our GitHub Actions webhook
-          webhook_id: '784184528997842985'
-          webhook_token: ${{ secrets.GHA_WEBHOOK_TOKEN }}
-
-          # Workflow information
-          workflow_name: ${{ github.workflow }}
-          run_id: ${{ github.run_id }}
-          run_number: ${{ github.run_number }}
-          status: ${{ job.status }}
-          actor: ${{ github.actor }}
-          repository:  ${{ github.repository }}
-          ref: ${{ github.ref }}
-          sha: ${{ github.sha }}
-
-          # Optional PR-information. These values will be "null" if
-          # the event trigger was not PR-related.
-          pr_author_login: ${{ github.event.pull_request.user.login }}
-          pr_number: ${{ github.event.pull_request.number }}
-          pr_title: ${{ github.event.pull_request.title }}
-          pr_source: ${{ github.event.pull_request.head.label }}
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 8dd93773..063f406c 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -91,35 +91,3 @@ jobs:
       - name: Run flake8
         run: "flake8 \
         --format='::error file=%(path)s,line=%(row)d,col=%(col)d::[flake8] %(code)s: %(text)s'"
-
-      # Send an informational status embed to Discord instead of the
-      # standard embeds that Discord sends. This embed will contain
-      # more information and we can fine tune when we actually want
-      # to send an embed.
-      - name: GitHub Actions Status Embed for Discord
-        # For a `pull_request` we always want to send a status embed
-        # here. For a push event, only when this workflow is the last
-        # in lint->build sequence because it failed or was cancelled.
-        if: github.event_name == 'pull_request' || cancelled() || failure()
-        uses: SebastiaanZ/[email protected]
-        with:
-          # Our GitHub Actions webhook
-          webhook_id: '784184528997842985'
-          webhook_token: ${{ secrets.GHA_WEBHOOK_TOKEN }}
-
-          # Workflow information
-          workflow_name: ${{ github.workflow }}
-          run_id: ${{ github.run_id }}
-          run_number: ${{ github.run_number }}
-          status: ${{ job.status }}
-          actor: ${{ github.actor }}
-          repository:  ${{ github.repository }}
-          ref: ${{ github.ref }}
-          sha: ${{ github.sha }}
-
-          # Optional PR-information. These values will be "null" if
-          # the event trigger was not PR-related.
-          pr_author_login: ${{ github.event.pull_request.user.login }}
-          pr_number: ${{ github.event.pull_request.number }}
-          pr_title: ${{ github.event.pull_request.title }}
-          pr_source: ${{ github.event.pull_request.head.label }}
diff --git a/.github/workflows/status_embed.yaml b/.github/workflows/status_embed.yaml
new file mode 100644
index 00000000..1d175fb9
--- /dev/null
+++ b/.github/workflows/status_embed.yaml
@@ -0,0 +1,71 @@
+name: Status Embed
+
+on:
+  workflow_run:
+    workflows:
+      - Lint
+      - Build
+    types:
+      - completed
+
+jobs:
+  status_embed:
+    # We send the embed in the following situations:
+    # - Always after the `Build` workflow, as it runs at the
+    #   end of our workflow sequence regardless of status.
+    # - Always for the `pull_request` event, as it only
+    #   runs one workflow.
+    # - Always run for non-success workflows, as they
+    #   terminate the workflow sequence.
+    if: >-
+      github.event.workflow_run.name == 'Build' ||
+      github.event.workflow_run.event == 'pull_request' ||
+      github.event.workflow_run.conclusion != 'success'
+    name:  Send Status Embed to Discord
+    runs-on: ubuntu-latest
+
+    steps:
+      # Unfortunately, not all the pull request information we
+      # need is available in the workflow_run payload. We need
+      # to fetch it from the API.
+      - name: Get Pull Request Information
+        if: github.event.workflow_run.event == 'pull_request'
+        uses: octokit/[email protected]
+        id: pull_request
+        with:
+          route: GET /repos/{owner}/{repo}/pulls
+          owner: ${{ github.event.repository.owner.login }}
+          repo: ${{ github.event.repository.name }}
+          state: open
+          head: ${{format(
+              '{0}:{1}',
+              github.event.workflow_run.head_repository.owner.login,
+              github.event.workflow_run.head_branch
+            )}}
+          sort: updated
+          direction: desc
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # Send an informational status embed to Discord instead of the
+      # standard embeds that Discord sends. This embed will contain
+      # more information and we can fine tune when we actually want
+      # to send an embed.
+      - name: GitHub Actions Status Embed for Discord
+        uses: SebastiaanZ/[email protected]
+        with:
+          # Our GitHub Actions webhook
+          webhook_id: '784184528997842985'
+          webhook_token: ${{ secrets.GHA_WEBHOOK_TOKEN }}
+
+          # Workflow information
+          workflow_name: ${{ github.event.workflow_run.name }}
+          run_id: ${{ github.event.workflow_run.id }}
+          run_number: ${{ github.event.workflow_run.run_number }}
+          status: ${{ github.event.workflow_run.conclusion }}
+          actor: ${{ github.actor }}
+          repository:  ${{ github.repository }}
+          ref: ${{ github.ref }}
+          sha: ${{ github.event.workflow_run.head_sha }}
+
+          pull_request_payload: ${{ steps.pull_request.outputs.data }}