feat: add greetings file

[CBID2]

Description

This PR adds a welcome.yml file.

Type of PR

[X] ✨ Feature
[] 🐞 Bug fix
[] 📄 Documentation update
[] Others

Related Issue

Closes #3

[geoffreylgv]

Hi @CBID2, this greeting GitHub action is nice tho.
I've been analyzing it since I saw it from Eddiehub repo.
Personally, I use the actions/first-interaction@v1, have you tried it before?

[CBID2]

Hi @CBID2, this greeting GitHub action is nice tho.

I've been analyzing it since I saw it from Eddiehub repo.

Personally, I use the actions/first-interaction@v1, have you tried it before?

No tell me more @geoffreylgv. :)

[geoffreylgv]

Hi @CBID2, this greeting GitHub action is nice tho.
I've been analyzing it since I saw it from Eddiehub repo.
Personally, I use the actions/first-interaction@v1, have you tried it before?

No tell me more @geoffreylgv. :)

Alright, It's also simple to use and pr or issue message customization; similar to the one you added

[geoffreylgv]

Allow me to suggest something, on the call of the github.actor, if you put the @ it will notice he/her (the actor)

 @${{ github.actor }}

[saragerion]

Hi @CBID2, thanks so much for opening this PR and contributing to shesharp! :)

This PR looks good, but I see an opportunity to harden the security of this Github workflow.

1. The GITHUB_TOKEN secret used in this action currently has write permissions on all scopes. This is more permissions than is necessary to perform its task in this action.
   Can you reduce the scope of the token permission to write on only the relevant scopes (issues and pull-requests).
   Reference: https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs#defining-access-for-the-github_token-scopes

See also:
Use credentials that are minimally scoped

2. I am ok with leveraging a community-created action but I would prefer if we pin the version by using a commit SHA rather than a branch or a tag. Using a SHA is generally suggested because of various reasons:

• It makes the third-party action's code immutable: the source action won't change over time with new releases so the action will always have a predictable behavior. New breaking changes won't impact our workflow.
• It helps mitigate the risk of a bad actor adding a backdoor to the third-party action's repository. Pinning to a commit SHA reduces this risk of unintentionally introducing malicious code in the future ( a branch or tag of an action can be compromised, the commit SHA is immutable).

See more info here: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

---

Related: while looking at this PR I realized that we can improve the security posture of other shesharp repositories as well so I created these new issues to address that effort:

shesharpnl/hackathon-2023.slack-bot.base-example#1
shesharpnl/hackathon-2021.twitter-bot.base-example#8
shesharpnl/hackathon-2021.slack-bot.base-example#1

[CBID2]

Hey @saragerion. I made the necessary changes

[saragerion]

Hi @CBID2, thanks for implementing this change.

Question: where did you find this commit SHA?
I do not see it in the main branch:
https://github.com/EddieHubCommunity/gh-action-community/commits/main
And this URL doesn't work:
https://github.com/EddieHubCommunity/gh-action-community/tree/bf67289baedda0b13e216f7ca14e733eab899963

[CBID2]

Hi @saragerion. Sorry for the long wait. I found a new greeting that they use: https://github.com/EddieHubCommunity/gh-action-community/blob/main/.github/workflows/community.yml
Here's the latest commit: EddieHubCommunity/gh-action-community@92d4d80

[adiati98]

Hey @CBID2,
How's the progress here? Do you need more time or help?

[CBID2]

Hey @CBID2,

How's the progress here? Do you need more time or help?

Hey @adiati98. I tried finding the latest version of the greeting in EddieHub's repo to no avail. It's needed in order to solve the security part.

[adiati98]

Hey @CBID2,
How's the progress here? Do you need more time or help?

Hey @adiati98. I tried finding the latest version of the greeting in EddieHub's repo to no avail. It's needed in order to solve the security part.

Do you want to keep working on this?

[CBID2]

Hey @CBID2,

How's the progress here? Do you need more time or help?

Hey @adiati98. I tried finding the latest version of the greeting in EddieHub's repo to no avail. It's needed in order to solve the security part.

Do you want to keep working on this?

Yes

[adiati98]

Hey @CBID2,

How's the progress here? Do you need more time or help?

Hey @adiati98. I tried finding the latest version of the greeting in EddieHub's repo to no avail. It's needed in order to solve the security part.

Do you want to keep working on this?

Yes

Awesome! Please keep us posted. 👍

And do let us know if you can't go further. We can close this and you can always create a new issue and PR once you figure something out. 🙂

[adiati98]

@CBID2 I want to inform that as there is no progress for this PR in the last 3 weeks, I'm putting it on draft. Feel free to change the status as "ready for review" once you've resolved it.

However, because it's already open for 4 months, if you haven't resolved it by next week (February 14th), I will close this PR. You can open a new issue and PR in that case if you're still interested. Thank you. 😊

cc: @saragerion