diff --git a/.github/scripts/notify_sdk_validation_failure.sh b/.github/scripts/notify_sdk_validation_failure.sh new file mode 100755 index 0000000000..75c9925434 --- /dev/null +++ b/.github/scripts/notify_sdk_validation_failure.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +# Notifies the APIx DevOps Integrations help usergroup when the Go SDK +# validation step fails during an OpenAPI spec release. +# +# The caller keys this notification to the "go-sdk-validation" step outcome, so +# a failure in an earlier setup step (Node, npm, artifact download, Spectral, +# Go) does not notify. The caller also suppresses duplicates across release +# retries. + +set -eou pipefail + +: "${SLACK_BEARER_TOKEN:?SLACK_BEARER_TOKEN is required}" +: "${SLACK_CHANNEL_ID:?SLACK_CHANNEL_ID is required}" +: "${SLACK_HELP_GROUP:?SLACK_HELP_GROUP is required}" +: "${TARGET_ENV:?TARGET_ENV is required}" +: "${RUN_URL:?RUN_URL is required}" + +SLACK_MESSAGE=$( + cat <> "${GITHUB_OUTPUT}" - return 0 + exit 0 fi echo "found-issue=false" >> "${GITHUB_OUTPUT}" diff --git a/.github/workflows/release-spec-runner.yml b/.github/workflows/release-spec-runner.yml index 1b64c39218..7889d3c779 100644 --- a/.github/workflows/release-spec-runner.yml +++ b/.github/workflows/release-spec-runner.yml @@ -58,6 +58,7 @@ jobs: api_bot_pat: ${{ secrets.API_BOT_PAT }} jira_api_token: ${{ secrets.JIRA_API_TOKEN }} bump_token: ${{secrets.BUMP_TOKEN}} + slack_bearer_token: ${{ secrets.SLACK_BEARER_TOKEN }} with: aws_default_region: ${{ vars.AWS_DEFAULT_REGION}} aws_s3_bucket: ${{ vars.S3_BUCKET_DEV}} @@ -78,6 +79,7 @@ jobs: api_bot_pat: ${{ secrets.API_BOT_PAT }} jira_api_token: ${{ secrets.JIRA_API_TOKEN }} bump_token: ${{secrets.BUMP_TOKEN}} + slack_bearer_token: ${{ secrets.SLACK_BEARER_TOKEN }} with: aws_default_region: ${{ vars.AWS_DEFAULT_REGION}} aws_s3_role_to_assume: ${{ vars.AWS_S3_ROLE_TO_ASSUME }} @@ -98,6 +100,7 @@ jobs: api_bot_pat: ${{ secrets.API_BOT_PAT }} jira_api_token: ${{ secrets.JIRA_API_TOKEN }} bump_token: ${{secrets.BUMP_TOKEN}} + slack_bearer_token: ${{ secrets.SLACK_BEARER_TOKEN }} with: aws_default_region: ${{ vars.AWS_DEFAULT_REGION}} aws_s3_role_to_assume: ${{ vars.AWS_S3_ROLE_TO_ASSUME }} @@ -120,6 +123,7 @@ jobs: workspace_id: ${{ secrets.WORKSPACE_ID }} jira_api_token: ${{ secrets.JIRA_API_TOKEN }} bump_token: ${{secrets.BUMP_TOKEN}} + slack_bearer_token: ${{ secrets.SLACK_BEARER_TOKEN }} with: aws_default_region: ${{ vars.AWS_DEFAULT_REGION}} aws_s3_role_to_assume: ${{ vars.AWS_S3_ROLE_TO_ASSUME }} diff --git a/.github/workflows/release-spec.yml b/.github/workflows/release-spec.yml index f8f48bde6e..500fc54a50 100644 --- a/.github/workflows/release-spec.yml +++ b/.github/workflows/release-spec.yml @@ -60,6 +60,8 @@ on: required: false bump_token: required: true + slack_bearer_token: + required: true permissions: contents: write @@ -86,6 +88,7 @@ jobs: uses: ./.github/workflows/required-spec-validations.yml secrets: api_bot_pat: ${{ secrets.api_bot_pat }} + slack_bearer_token: ${{ secrets.slack_bearer_token }} with: env: ${{ inputs.env }} diff --git a/.github/workflows/required-spec-validations.yml b/.github/workflows/required-spec-validations.yml index 084223da6a..5dee7bc603 100644 --- a/.github/workflows/required-spec-validations.yml +++ b/.github/workflows/required-spec-validations.yml @@ -9,6 +9,8 @@ on: secrets: # all secrets are passed explicitly in this workflow api_bot_pat: required: true + slack_bearer_token: + required: true permissions: contents: write @@ -74,3 +76,26 @@ jobs: pushd atlas-sdk-go make -e openapi-pipeline popd + # Notify the APIx DevOps Integrations on-call so an SDK validation + # failure is routed quickly. Keyed to the go-sdk-validation step + # outcome: an earlier setup failure (Node, npm, artifact download, + # Spectral, Go, SDK checkout) leaves this step without a failure + # outcome, so it does not notify. + - name: Notify the Go SDK validation failure + # Notify once per incident. The release retry handler requests a + # rerun of failed jobs while github.run_attempt < 3, so attempt 3 is + # the first attempt after the automatic retries are exhausted. + # Attempts beyond 3 come from reruns the handler already queued and + # would duplicate the alert. + if: ${{ failure() && steps.go-sdk-validation.outcome == 'failure' && fromJSON(github.run_attempt) == 3 }} + env: + SLACK_BEARER_TOKEN: ${{ secrets.slack_bearer_token }} + # #cloud-apix-devops-integrations-notifications and + # @apix-devops-integrations-help (S0C2KP6E273). These are + # non-sensitive IDs, kept inline because only the repo owner can + # manage repository secrets. + SLACK_CHANNEL_ID: C06Q7QF1ZST + SLACK_HELP_GROUP: '' + TARGET_ENV: ${{ inputs.env }} + RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + run: .github/scripts/notify_sdk_validation_failure.sh