feat(PLT-3863): add incident hotfix deploy support

[jhuliano]

Adds incident-number input to the frontend deploy workflow. When set, validates INC-* format and posts a war-room notification before deploying.

Jira: https://typeform.atlassian.net/browse/PLT-3863

[gitstream-cm]

🚨 gitStream Monthly Automation Limit Reached 🚨

Your organization has exceeded the number of pull requests allowed for automation with gitStream.
Monthly PRs automated: 250/250

To continue automating your PR workflows and unlock additional features, please contact LinearB.

[pr-auditor]

⚠️ Security Analysis Results

Analysis Summary:

• 📁 Files reviewed: 1
• 🟡 Medium severity: 1 issues

🟡 Medium Severity Issues

Issue 1: template_injection

📁 File: .github/workflows/frontend-deploy-workflow.yml (Line 797)

📝 Description:
The Slack war-room notification payload is constructed by directly interpolating ${{ inputs.app-name }} into a raw JSON string without any encoding or escaping. The incident-number input is correctly validated against ^[Ii][Nn][Cc]-[0-9]+$ before the Slack step runs, but app-name receives no equivalent sanitization before being embedded in the JSON payload. A value containing a double-quote character (e.g. my-app","channel":"exec-alerts,"text":"false alert) will produce syntactically valid but attacker-controlled JSON, potentially redirecting the message to an arbitrary Slack channel or injecting misleading text into a war-room notification.

⚠️ Exploit Scenario:
A workflow caller (or a calling workflow that accepts app-name from a workflow_dispatch trigger) supplies an app-name value of: legit-app","channel":"ceo-channel","text":"🚨 PRODUCTION IS DOWN – ALL HANDS. Because ${{ inputs.app-name }} is expanded verbatim inside the JSON string literal, the Slack API receives a well-formed JSON object with channel overridden to ceo-channel and an arbitrary text payload. This can be used to impersonate incident notifications, suppress the legitimate war-room alert, or misdirect responders during a real incident.

🔧 Recommendation:
Validate or sanitize inputs.app-name before it is used in any JSON context. The safest approach for this workflow is to pass all user-controlled values as environment variables into the step and construct the JSON in a shell heredoc using a tool that performs proper JSON encoding (e.g. jq -n --arg text "..." '{channel:"war-room",text:$text}'), or use the slackapi/slack-github-action payload-file-path option with a file written via jq. At minimum, add a validation step for app-name analogous to the one already added for incident-number.

🎯 Confidence: 3/5

---

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page