ci: make a missing Slack webhook a clear failure, not a cryptic one

The weekly release failed on Aug 28 and the alert never reached Slack. The
notify job failed with:

    Missing input! Either a method or webhook is required to take action.

COSY_WEBHOOK_URL resolves to an empty string, so GitHub omits the `webhook`
input entirely and the action rejects the call. The secret exists but was
created 2026-08-12 and never updated -- one day before the weekly release
workflow landed in #108 -- and the notify path was not exercised until the
Aug 28 failure, so this alert has never worked.

Check the webhook in a preflight step that names the missing secret, and set
errors: true so Slack-side delivery failures fail the step instead of
reporting green.

Neither change can populate the secret; that still needs setting in repo
settings. They make the next failure say so in one line.

Author: carole-lavillonniere

.github/workflows/weekly-release.yml

@@ -82,13 +82,31 @@ jobs:
       - version
       - release
     steps:
+      # Check the webhook before handing it to the action. An unset or blank secret otherwise
+      # fails with "Missing input! Either a method or webhook is required to take action.",
+      # which reads like a workflow syntax bug rather than a missing secret -- that is how the
+      # Aug 28 alert was lost.
+      - name: Verify the Slack webhook is configured
+        env:
+          WEBHOOK: ${{ secrets.COSY_WEBHOOK_URL }}
+        run: |
+          if [ -z "${WEBHOOK}" ]; then
+            echo "::error::COSY_WEBHOOK_URL is unset or empty, so no Slack alert can be sent for this broken release. Set it under Settings > Secrets and variables > Actions."
+            exit 1
+          fi
+          echo "Webhook is configured."
+
       - name: "Send Message"
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         env:
           MESSAGE: "_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:"
         with:
           webhook: ${{ secrets.COSY_WEBHOOK_URL }}
           webhook-type: incoming-webhook
+          # Default is false, which swallows Slack-side delivery errors and reports the step as
+          # green. For the alert that tells us releases are broken, a silent failure is the one
+          # outcome we cannot afford.
+          errors: true
           payload: |
             blocks:
               - type: "section"