fix: deliver announcements through a scoped Discord webhook (#2737)

* test: reproduce Discord webhook announcement gap

* fix: deliver ECC announcements through channel webhook

* test: cover webhook replay and least privilege

* fix: make webhook delivery durable and least privilege

* test: cover trusted receipts and cross-workflow races

* fix: serialize and authenticate announcement receipts

.github/workflows/discussion-announce.yml

@@ -3,17 +3,24 @@ name: Discussion Announce
 on:
   discussion:
     types: [created]
+  workflow_dispatch:
+    inputs:
+      discussion_number:
+        description: Existing Announcement discussion number to deliver
+        required: true
+        type: number
 
 permissions:
   contents: read
+  discussions: write
 
 concurrency:
-  group: discord-discussion-${{ github.event.discussion.node_id }}
+  group: ecc-discord-announcement-delivery
   cancel-in-progress: false
 
 jobs:
   announce:
-    if: github.event.discussion.category.name == 'Announcements'
+    if: github.event_name == 'workflow_dispatch' || github.event.discussion.category.name == 'Announcements'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout trusted default branch
@@ -24,12 +31,13 @@ jobs:
       - name: Send announcement to Discord
         run: node scripts/discord/release-announce.mjs
         env:
-          ANNOUNCEMENT_KIND: discussion
-          DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
-          DISCORD_ANNOUNCE_CHANNEL_ID: ${{ secrets.DISCORD_ANNOUNCE_CHANNEL_ID }}
+          ANNOUNCEMENT_KIND: ${{ github.event_name == 'workflow_dispatch' && 'manual' || 'discussion' }}
+          DISCORD_ANNOUNCE_WEBHOOK_URL: ${{ secrets.DISCORD_ANNOUNCE_WEBHOOK_URL }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           DISCUSSION_ID: ${{ github.event.discussion.node_id }}
           DISCUSSION_TITLE: ${{ github.event.discussion.title }}
           DISCUSSION_BODY: ${{ github.event.discussion.body }}
           DISCUSSION_URL: ${{ github.event.discussion.html_url }}
           DISCUSSION_CATEGORY: ${{ github.event.discussion.category.name }}
+          DISCUSSION_NUMBER: ${{ inputs.discussion_number }}

.github/workflows/release-announce.yml

@@ -9,7 +9,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: discord-release-${{ github.event.workflow_run.id }}
+  group: ecc-discord-announcement-delivery
   cancel-in-progress: false
 
 jobs:
@@ -29,8 +29,7 @@ jobs:
         run: node scripts/discord/release-announce.mjs
         env:
           ANNOUNCEMENT_KIND: release
-          DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
-          DISCORD_ANNOUNCE_CHANNEL_ID: ${{ secrets.DISCORD_ANNOUNCE_CHANNEL_ID }}
+          DISCORD_ANNOUNCE_WEBHOOK_URL: ${{ secrets.DISCORD_ANNOUNCE_WEBHOOK_URL }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           RELEASE_TAG: ${{ github.event.workflow_run.head_branch }}