fix: read the alert webhooks from one JSON secret - #135
Merged
Conversation
Actions refuses to schedule a run whose workflow uses toJSON(secrets). The run completes in about a second with zero jobs and conclusion action_required, and reports no error anywhere - it looks like the workflow simply did not run. Confirmed by dispatching the same workflow twice from a branch, identical apart from that expression: with it, zero jobs; without it, resolve succeeded and bootstrap reached its approval gate as normal. That expression was there because GitHub cannot index secrets by a computed name and each channel needs its own webhook. The replacement is one ALERT_WEBHOOKS secret holding a JSON object keyed by secretKey, which needs no dynamic lookup, and does not hand KUBECONFIG and the wildcard private key to a step that has no use for them. Bootstrap now fails with a clear message when alerting is on and ALERT_WEBHOOKS is unset or is not a JSON object, rather than writing an empty Secret. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019qeiQRFu8xAMRYWPdZewjG
|
Warning Review limit reachedNext included review available in 13 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
toJSON(secrets)makes Actions refuse to schedule the run at all: it completes in about a second with zero jobs and conclusionaction_required, reporting no error anywhere. The bootstrap workflow was unrunnable from the moment #132 merged, and the failure mode gives you nothing to go on.Confirmed rather than guessed: I dispatched the same workflow twice from a branch, identical apart from that one expression. With it, zero jobs. Without it,
resolvesucceeded andbootstrapreached its environment approval gate as normal.Replaced with a single
ALERT_WEBHOOKSsecret holding a JSON object keyed by each channel'ssecretKey. That needs no dynamic lookup, and it keepsKUBECONFIGand the wildcard private key out of a step that has no use for them - which the previous approach handed over for free.Bootstrap now also fails with a clear message when alerting is on and the secret is missing or is not a JSON object, instead of writing an empty Secret and producing an AlertmanagerConfig that notifies nobody.
Verified: actionlint, shellcheck,
test-deploy-logic.shALL PASS. The secret is already set oncluster-eduide.🤖 Generated with Claude Code
https://claude.ai/code/session_019qeiQRFu8xAMRYWPdZewjG