Slack webhook gets invalidated because of using it publically as a string inside .yaml file

[xoldd]

Issue workflow progress

Progress of the issue based on the Contributor Workflow

• [ ] 1. The issue provides a reproduction available on GitHub, Stackblitz or CodeSandbox

  Make sure to fork this template and run yarn generate in the terminal.

  Please make sure the Codegen and plugins version under package.json matches yours.

• [ ] 2. A failing test has been provided
• [ ] 3. A local solution has been provided
• [ ] 4. A pull request is pending review

---

Describe the bug

Slack invalidates the webhook url if it is exposed publically on the github repo. Graphql-inspector official docs only mention this way of passing in the webhook url to .yaml file.

To Reproduce Steps to reproduce the behavior:

Follow graphql-inspector instructions to set up schema change notifications for slack.

Here's the slack email describing this issue:-

Graphql-inspector should work with github secrets so that we can provide the webhook url as a secret inside .yaml file. If this feature already exists it should be documented on the official docs.

• OS:
• @graphql-inspector/...:
• graphql:
• NodeJS:

Additional context