From d98d6951efc281c372c664af7ac1fb761d0068f1 Mon Sep 17 00:00:00 2001 From: Faye Date: Fri, 23 Oct 2026 14:23:24 +0200 Subject: [PATCH 1/3] ci: rename MERKELY_SLACK_CI_FAILURES_WEBHOOK secret to SLACK_CI_FAILURES_WEBHOOK Co-Authored-By: Claude Fable 5.1 --- .github/workflows/daily-cli-tests.yml | 4 ++-- .github/workflows/main.yml | 6 +++--- .github/workflows/release.yml | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/daily-cli-tests.yml b/.github/workflows/daily-cli-tests.yml index 60a7b3f56..192773556 100644 --- a/.github/workflows/daily-cli-tests.yml +++ b/.github/workflows/daily-cli-tests.yml @@ -47,7 +47,7 @@ jobs: azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} bitbucket_access_token: ${{ secrets.KOSLI_BITBUCKET_ACCESS_TOKEN }} jira_api_token: ${{ secrets.KOSLI_JIRA_API_TOKEN }} - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} + slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} slack_channel: ci-failures snyk_token: ${{ secrets.SNYK_TOKEN }} kosli_reporting_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} @@ -107,5 +107,5 @@ jobs: - name: Slack Notification on Failure uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main with: - slack_url: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} + slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e7b0121e6..37cbf24f2 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -108,7 +108,7 @@ jobs: azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} bitbucket_access_token: ${{ secrets.KOSLI_BITBUCKET_ACCESS_TOKEN }} jira_api_token: ${{ secrets.KOSLI_JIRA_API_TOKEN }} - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} + slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} slack_channel: ci-failures snyk_token: ${{ secrets.SNYK_TOKEN }} kosli_reporting_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} @@ -127,7 +127,7 @@ jobs: checkout_ref: ${{ needs.pre-build.outputs.checkout_ref }} report_to_kosli: ${{ needs.pre-build.outputs.report_to_kosli }} secrets: - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} + slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} slack_channel: ci-failures kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} snyk_token: ${{ secrets.SNYK_TOKEN }} @@ -154,5 +154,5 @@ jobs: - name: Slack Notification on Failure uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main with: - slack_url: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} + slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 908a43f6b..413cc8ce8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -105,7 +105,7 @@ jobs: azure_client_id: ${{ secrets.AZURE_CLIENT_ID }} azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} bitbucket_access_token: ${{ secrets.KOSLI_BITBUCKET_ACCESS_TOKEN }} - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} + slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} slack_channel: ci-failures jira_api_token: ${{ secrets.KOSLI_JIRA_API_TOKEN }} snyk_token: ${{ secrets.SNYK_TOKEN }} @@ -124,7 +124,7 @@ jobs: kosli_org: kosli-public report_to_kosli: release secrets: - slack_webhook: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} + slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} slack_channel: ci-failures kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} snyk_token: ${{ secrets.SNYK_TOKEN }} From 0a2d0ccdb05d58b2991104412ce43046981844a3 Mon Sep 17 00:00:00 2001 From: Faye Date: Fri, 23 Oct 2026 14:31:04 +0200 Subject: [PATCH 2/3] ci: drop unused slack secrets from reusable workflows and notify ci-failures on release failure The test and docker reusable workflows declared slack_channel and slack_webhook as required secrets but never read them; the failure notifications are sent by the calling workflows directly. Remove the dead declarations and their pass-throughs. The release workflow had no ci-failures notification at all, so a test failure during a release went unreported there. Add the same slack-notification-on-failure job that main.yml and the daily tests use. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/daily-cli-tests.yml | 2 -- .github/workflows/docker.yml | 4 --- .github/workflows/main.yml | 4 --- .github/workflows/release.yml | 36 ++++++++++++++++++++++++--- .github/workflows/test.yml | 4 --- 5 files changed, 32 insertions(+), 18 deletions(-) diff --git a/.github/workflows/daily-cli-tests.yml b/.github/workflows/daily-cli-tests.yml index 192773556..754c6dabe 100644 --- a/.github/workflows/daily-cli-tests.yml +++ b/.github/workflows/daily-cli-tests.yml @@ -47,8 +47,6 @@ jobs: azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} bitbucket_access_token: ${{ secrets.KOSLI_BITBUCKET_ACCESS_TOKEN }} jira_api_token: ${{ secrets.KOSLI_JIRA_API_TOKEN }} - slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures snyk_token: ${{ secrets.SNYK_TOKEN }} kosli_reporting_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} kosli_querying_api_token: ${{ secrets.KOSLI_API_TOKEN_PROD }} diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 02b330831..cc41c0c16 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -30,10 +30,6 @@ on: type: string default: 'none' secrets: - slack_channel: - required: true - slack_webhook: - required: true kosli_api_token: required: true snyk_token: diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 37cbf24f2..624581a0b 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -108,8 +108,6 @@ jobs: azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} bitbucket_access_token: ${{ secrets.KOSLI_BITBUCKET_ACCESS_TOKEN }} jira_api_token: ${{ secrets.KOSLI_JIRA_API_TOKEN }} - slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures snyk_token: ${{ secrets.SNYK_TOKEN }} kosli_reporting_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} kosli_querying_api_token: ${{ secrets.KOSLI_API_TOKEN_PROD }} @@ -127,8 +125,6 @@ jobs: checkout_ref: ${{ needs.pre-build.outputs.checkout_ref }} report_to_kosli: ${{ needs.pre-build.outputs.report_to_kosli }} secrets: - slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} snyk_token: ${{ secrets.SNYK_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 413cc8ce8..9e12f2a3f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -105,8 +105,6 @@ jobs: azure_client_id: ${{ secrets.AZURE_CLIENT_ID }} azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }} bitbucket_access_token: ${{ secrets.KOSLI_BITBUCKET_ACCESS_TOKEN }} - slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures jira_api_token: ${{ secrets.KOSLI_JIRA_API_TOKEN }} snyk_token: ${{ secrets.SNYK_TOKEN }} kosli_reporting_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} @@ -124,8 +122,6 @@ jobs: kosli_org: kosli-public report_to_kosli: release secrets: - slack_webhook: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} - slack_channel: ci-failures kosli_api_token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }} snyk_token: ${{ secrets.SNYK_TOKEN }} @@ -309,6 +305,38 @@ jobs: AWS_ACCOUNT_ID: 585008075785 AWS_REGION: eu-central-1 + slack-notification-on-failure: + runs-on: ubuntu-24.04 + permissions: + actions: read + contents: read + needs: + [ + pre-build, + init-kosli, + never-alone-trail, + test, + docker, + goreleaser, + binary-provenance, + docs-repo-dispatch, + evidence-reporter-upload-package-and-deploy, + environment-reporter-upload-package-and-deploy, + environment-reporter-upload-layer + ] + if: ${{ always() && contains(join(needs.*.result, ','), 'failure') }} + steps: + - name: Harden Runner + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + with: + egress-policy: audit + + - name: Slack Notification on Failure + uses: kosli-dev/reusable-actions/.github/actions/send-ci-failure-slack-message@main + with: + slack_url: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }} + github_token: ${{ secrets.GITHUB_TOKEN }} + notify-finish: needs: [ diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f5bcd09d6..975124f07 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -39,10 +39,6 @@ on: type: string default: '' secrets: - slack_channel: - required: true - slack_webhook: - required: true github_access_token: required: true gitlab_access_token: From 2ef1c3e9c92ec7761005d40f2d1916d272ff57bb Mon Sep 17 00:00:00 2001 From: Faye Date: Fri, 23 Oct 2026 14:49:14 +0200 Subject: [PATCH 3/3] ci: report cancelled release jobs and notify-start failures to ci-failures The release failure notification only fired on 'failure', while notify-finish also treats 'cancelled' as a failed release. It also did not depend on notify-start, so a broken Slack bot token left the failure unreported everywhere. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9e12f2a3f..f00f174c8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -312,6 +312,7 @@ jobs: contents: read needs: [ + notify-start, pre-build, init-kosli, never-alone-trail, @@ -324,7 +325,7 @@ jobs: environment-reporter-upload-package-and-deploy, environment-reporter-upload-layer ] - if: ${{ always() && contains(join(needs.*.result, ','), 'failure') }} + if: ${{ always() && (contains(join(needs.*.result, ','), 'failure') || contains(join(needs.*.result, ','), 'cancelled')) }} steps: - name: Harden Runner uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2