From 87bc8a85585a17c4d64f048d34aa907d8a7ad593 Mon Sep 17 00:00:00 2001 From: carole-lavillonniere Date: Mon, 31 Aug 2026 13:49:59 +0200 Subject: [PATCH 1/3] ci: make a missing Slack webhook a clear failure, not a cryptic one The weekly release failed on Aug 28 and the alert never reached Slack. The notify job failed with: Missing input! Either a method or webhook is required to take action. COSY_WEBHOOK_URL resolves to an empty string, so GitHub omits the `webhook` input entirely and the action rejects the call. The secret exists but was created 2026-08-12 and never updated -- one day before the weekly release workflow landed in #108 -- and the notify path was not exercised until the Aug 28 failure, so this alert has never worked. Check the webhook in a preflight step that names the missing secret, and set errors: true so Slack-side delivery failures fail the step instead of reporting green. Neither change can populate the secret; that still needs setting in repo settings. They make the next failure say so in one line. --- .github/workflows/weekly-release.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml index 6102e49..4a2b4b2 100644 --- a/.github/workflows/weekly-release.yml +++ b/.github/workflows/weekly-release.yml @@ -82,6 +82,20 @@ jobs: - version - release steps: + # Check the webhook before handing it to the action. An unset or blank secret otherwise + # fails with "Missing input! Either a method or webhook is required to take action.", + # which reads like a workflow syntax bug rather than a missing secret -- that is how the + # Aug 28 alert was lost. + - name: Verify the Slack webhook is configured + env: + WEBHOOK: ${{ secrets.COSY_WEBHOOK_URL }} + run: | + if [ -z "${WEBHOOK}" ]; then + echo "::error::COSY_WEBHOOK_URL is unset or empty, so no Slack alert can be sent for this broken release. Set it under Settings > Secrets and variables > Actions." + exit 1 + fi + echo "Webhook is configured." + - name: "Send Message" uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 env: @@ -89,6 +103,10 @@ jobs: with: webhook: ${{ secrets.COSY_WEBHOOK_URL }} webhook-type: incoming-webhook + # Default is false, which swallows Slack-side delivery errors and reports the step as + # green. For the alert that tells us releases are broken, a silent failure is the one + # outcome we cannot afford. + errors: true payload: | blocks: - type: "section" From 92eadcf2450c6ecc7fa68145862f9860331ad449 Mon Sep 17 00:00:00 2001 From: carole-lavillonniere Date: Mon, 31 Aug 2026 14:07:44 +0200 Subject: [PATCH 2/3] ci: send the Slack payload as JSON with a literal-newline message slack-github-action v4 ships js-yaml v5, which enforces stricter multiline indentation. MESSAGE was a double-quoted YAML scalar, so its \n\n became real newlines that were interpolated into the YAML payload at column 0 and broke the document: Invalid input! Failed to parse contents of the provided payload SyntaxError: Expected property name or '}' in JSON at position 1 Single-quote MESSAGE so \n stays a two-character escape, and send the payload as JSON, where an interpolated message cannot break the structure and \n is exactly the newline Slack mrkdwn renders. Verified end to end on a throwaway branch: the notify job was forced to run under dryRun and delivered to Slack with errors: true, so a rejected delivery would have failed the step. --- .github/workflows/weekly-release.yml | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml index 4a2b4b2..d2c74ea 100644 --- a/.github/workflows/weekly-release.yml +++ b/.github/workflows/weekly-release.yml @@ -99,7 +99,10 @@ jobs: - name: "Send Message" uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 env: - MESSAGE: "_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:" + # Single-quoted so \n stays a two-character escape. In a double-quoted YAML scalar it + # becomes a real newline, which lands unindented inside the payload below and breaks + # parsing under the stricter js-yaml v5 rules that slack-github-action v4 ships. + MESSAGE: '_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:' with: webhook: ${{ secrets.COSY_WEBHOOK_URL }} webhook-type: incoming-webhook @@ -107,9 +110,14 @@ jobs: # green. For the alert that tells us releases are broken, a silent failure is the one # outcome we cannot afford. errors: true + # JSON rather than YAML: an interpolated message cannot break the document structure, + # and \n inside a JSON string is exactly the newline Slack mrkdwn wants. payload: | - blocks: - - type: "section" - text: - type: "mrkdwn" - text: "${{ env.MESSAGE }}" + { + "blocks": [ + { + "type": "section", + "text": { "type": "mrkdwn", "text": "${{ env.MESSAGE }}" } + } + ] + } From 50fab3aaf49e4a24efcf2b6890daeab040a24a61 Mon Sep 17 00:00:00 2001 From: carole-lavillonniere Date: Mon, 31 Aug 2026 14:15:31 +0200 Subject: [PATCH 3/3] ci: drop explanatory comments from the notify job --- .github/workflows/weekly-release.yml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml index d2c74ea..463af75 100644 --- a/.github/workflows/weekly-release.yml +++ b/.github/workflows/weekly-release.yml @@ -82,10 +82,6 @@ jobs: - version - release steps: - # Check the webhook before handing it to the action. An unset or blank secret otherwise - # fails with "Missing input! Either a method or webhook is required to take action.", - # which reads like a workflow syntax bug rather than a missing secret -- that is how the - # Aug 28 alert was lost. - name: Verify the Slack webhook is configured env: WEBHOOK: ${{ secrets.COSY_WEBHOOK_URL }} @@ -99,19 +95,11 @@ jobs: - name: "Send Message" uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 env: - # Single-quoted so \n stays a two-character escape. In a double-quoted YAML scalar it - # becomes a real newline, which lands unindented inside the payload below and breaks - # parsing under the stricter js-yaml v5 rules that slack-github-action v4 ships. MESSAGE: '_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:' with: webhook: ${{ secrets.COSY_WEBHOOK_URL }} webhook-type: incoming-webhook - # Default is false, which swallows Slack-side delivery errors and reports the step as - # green. For the alert that tells us releases are broken, a silent failure is the one - # outcome we cannot afford. errors: true - # JSON rather than YAML: an interpolated message cannot break the document structure, - # and \n inside a JSON string is exactly the newline Slack mrkdwn wants. payload: | { "blocks": [