Add report CI errors github action

.github/actions/report-run-failure/README.md

@@ -0,0 +1,30 @@
+## Notes on using this action
+
+  - This action relies on GOVUK_SLACK_WEBHOOK_URL actions secret being configured for the repository. It’s added to all GOV.UK repositories as an organisation secret in the [GOV.UK GitHub Infrastructure configuration](https://github.com/alphagov/govuk-infrastructure/blob/main/terraform/deployments/github/main.tf)
+  - To minimise noise, the slack message is only sent out for failures on the main branch.
+
+## Usage example:
+
+The code below indicates where to insert the lines and what lines to copy across.
+
+```
+name: Always failing job
+on:
+  workflow_dispatch:
+
+jobs:
+  failed-run:
+    name: Failed run
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Always failing
+        run: exit 1
+
+      # copy lines below to report a github failure to your team channel
+      - if: ${{ failure() }}
+        uses: alphagov/govuk-infrastrtucture/.github/actions/report-run-failure@main
+        with:
+          slack_webhook_url: ${{ secrets.GOVUK_SLACK_WEBHOOK_URL }}
+          channel: your-team-slack-channel
+          message: an optional message
+```

.github/actions/report-run-failure/action.yaml

@@ -0,0 +1,51 @@
+name: "Report Github run failure to slack channel"
+description: "Report Github run failure to a nominated slack channel"
+inputs:
+  slack_webhook_url:
+    description: "Slack webhook URL"
+    required: true
+  channel:
+    description: "Name of the channel to send failure notifications to"
+    required: true
+  message:
+    description: "Optional message to show in channel"
+    default: ""
+runs:
+  using: "composite"
+  steps:
+    - if:  ${{ github.ref_name == 'main' }}
+      run: |
+        # run checks as github actions required is not being enforced - https://github.com/actions/runner/issues/1070
+        [[ "${{ inputs.slack_webhook_url }}" ]] || { echo "slack_webhook_url input is empty" ; exit 1; }
+        [[ "${{ inputs.channel }}" ]] || { echo "channel input is empty" ; exit 1; }
+      shell: bash
+    - if:  ${{ github.ref_name == 'main' }}
+      name: Send slack message
+      uses: slackapi/[email protected]
+      with:
+        errors: true
+        webhook: ${{ inputs.slack_webhook_url }}
+        webhook-type: incoming-webhook
+        payload: |
+          {
+            "channel": "${{ inputs.channel }}",
+            "text": "The <https://github.com/${{ github.repository }}> Github run failed.",
+            "blocks": [
+              {
+                "type": "section",
+                "text": {
+                  "type": "mrkdwn",
+                  "text": "The <https://github.com/${{ github.repository }}> failed on ${{ github.ref_name }}.\n${{ inputs.message }}",
+                },
+                "accessory": {
+                  "type": "button",
+                  "text": {
+                      "type": "plain_text",
+                      "text": "Check the build logs"
+                  },
+                  "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+                  "action_id": "button-view-workflow"
+                }
+              }
+            ]
+          }

terraform/deployments/github/main.tf

@@ -251,3 +251,8 @@ resource "github_actions_organization_secret_repositories" "pact_broker_username
   secret_name             = "GOVUK_PACT_BROKER_USERNAME" # pragma: allowlist secret
   selected_repository_ids = [for repo in local.pact_publishers : repo.repo_id]
 }
+
+resource "github_actions_organization_secret_repositories" "slack_webhook_url" {
+  secret_name             = "GOVUK_SLACK_WEBHOOK_URL" # pragma: allowlist secret
+  selected_repository_ids = [for repo in local.deployable_repos : repo.repo_id]
+}