Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions .github/workflows/slack-on-failure.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,9 @@ name: 'Report a failed run to Slack'
# nobody anticipated is posted rather than passed over. The filters are here, not in each
# caller, so no caller can get them wrong.
#
# A post Slack does not accept fails this job, so a broken webhook is a red run of the watcher
# rather than a failure that silently reached nobody.
# A post Slack does not accept fails this job, with Slack's answer in the error. Nothing
# reports the watcher's own run, so a webhook that stops working is noticed only by the absence
# of posts: an accepted limitation (README.md).
on:
workflow_call:
inputs:
Expand Down
9 changes: 6 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -146,9 +146,12 @@ jobs:
secret set on the organisation is every repository's default, and a repository secret of the
same name overrides it. An incoming webhook posts to one channel and can do nothing else.
- **A post that fails, fails the watcher's run**, with Slack's answer in the error: a missing
secret, a webhook Slack refuses, or Slack unreachable after retries. So a broken webhook shows
as a red watcher run rather than a failure that reached nobody. A transient refusal is
retried, which can post the same failure twice.
secret, a webhook Slack refuses, or Slack unreachable after retries. A transient refusal is
retried, which can post the same failure twice. **Accepted limitation:** the watcher's run is
itself a run nobody is watching, and nothing reports it, so a webhook that stops working is
noticed only by the absence of posts. Filing an issue instead would scatter them across
repositories if filed in the failing one, and if filed here would need either a credential
that can write across repositories or a scheduled sweep of every repository's watcher runs.
- **The watcher only fires from the default branch**, where GitHub reads `workflow_run`
triggers. So a change to it is tested only once merged.
- **The caller must grant** `actions: read` and `contents: read`, as the example does, or
Expand Down
Loading