[DT-4048] fix triage notifications not triggering, switch to inline notification

[ardiewen]

Description & motivation 💭

Followup to DT-4048: the original Slack notification design used a separate workflow (a11y-bucket-notify.yml) triggered by pull_request: labeled. That design was structurally broken because GitHub explicitly does not fire downstream workflows from events triggered by GITHUB_TOKEN (recursion-prevention). The triage workflow applied bucket labels via actions/github-script (which uses GITHUB_TOKEN), so the resulting labeled events were delivered but the notification workflow never ran.

This PR collapses the two-workflow design into one. The triage workflow now fires the Slack chat.postMessage directly via fetch when its toAdd label diff includes a11y:bucket-3 or a11y:bucket-4. The marker-based dedup behavior is preserved (still uses a hidden bot comment to track the last-pinged bucket and skip on re-runs). a11y-bucket-notify.yml is deleted.

Sibling PR: cloud-ui#2690.

Screenshots (if applicable) 📸

N/A — pure CI / tooling change. No UI surfaces.

Design Considerations 🎨

• author_association allowlist widened to include CONTRIBUTOR. During smoke testing we discovered that GITHUB_TOKEN-scoped API lookups return CONTRIBUTOR for org members with private membership (since the repo-scope token can't see the private org membership). For OSS UI, a CONTRIBUTOR is still a vetted prior-merge author, not a drive-by — pairing that with the title gate + manifest lookup is sufficient gating. External drop-in PRs would have author_association = NONE or FIRST_TIMER, which we still filter.
• Channel resolution unchanged: ${{ vars.DESIGN_FEEDBACK_SLACK_CHANNEL }} repo variable.
• No inter-step output passing. The previous draft tried to pass outputs from the github-script step to a separate slackapi/slack-github-action step; the outputs didn't propagate reliably in actions/github-script@v7. Doing the Slack call inline in github-script (via the global fetch) is the most robust path.
• Idempotent re-dispatches. Re-running on an already-bucket-3 PR sees newlyAddedBucket = undefined and skips the Slack path entirely. The dedup marker handles the trailer-edit-cycle case (remove then re-add the trailer → same bucket → single ping).

Testing 🧪

How was this tested 👻

• Manual testing — smoke test PR in cloud-ui (workflow logic is identical between the two repos modulo the channel string).
• E2E tests added (n/a — CI workflow).
• Unit tests added (n/a).

Smoke test details: opened a draft PR titled a11y(1.4.12): smoke v4 debug in cloud-ui with A11y-Audit-Ref: 1.4.12-cloud-breadcrumb-overflow. Workflow run 26640915135 emitted Slack ping sent (a11y:bucket-3) to #team-feux and the message landed in #team-feux. Smoke PR closed; main test artifacts (labels, marker comment) are visible on cloud-ui#2700.

Steps for others to test 🚶🏽‍♂️🚶🏽‍♀️

After merge, the workflow will fire Slack inline on the next pull_request event (or workflow_dispatch) that newly transitions a PR into Bucket-3 or Bucket-4. Verify by checking the workflow run on the next a11y PR that gets a Bucket-3+ label.

Checklists

Draft Checklist

(none)

Merge Checklist

(none)

Issue(s) closed

Followup to DT-4048.

Docs

Any docs updates needed?

None. Slack notification semantics are unchanged from the user's perspective; the workflow architecture change is internal.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
holocene	Ready	Preview, Comment	May 29, 2026 5:34pm