From 8d426539fa297e7bc901e5c55292accba37b67bd Mon Sep 17 00:00:00 2001
From: Leo Antoli <leo.antoli@mongodb.com>
Date: Wed, 14 Oct 2026 13:04:05 +0200
Subject: [PATCH 1/2] ci: Notify the Go SDK validation failure on Slack

Post a Slack message to the APIx DevOps Integrations help usergroup when the go-sdk-validation step fails during an OpenAPI spec release. The step is keyed to steps.go-sdk-validation.outcome, so a failure in an earlier setup step does not notify, and it runs once per incident after the automatic release retries are exhausted.
---
 .../scripts/notify_sdk_validation_failure.sh  | 50 +++++++++++++++++++
 .github/workflows/release-spec-runner.yml     |  4 ++
 .github/workflows/release-spec.yml            |  3 ++
 .../workflows/required-spec-validations.yml   | 25 ++++++++++
 4 files changed, 82 insertions(+)
 create mode 100755 .github/scripts/notify_sdk_validation_failure.sh

diff --git a/.github/scripts/notify_sdk_validation_failure.sh b/.github/scripts/notify_sdk_validation_failure.sh
new file mode 100755
index 0000000000..75c9925434
--- /dev/null
+++ b/.github/scripts/notify_sdk_validation_failure.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+# Notifies the APIx DevOps Integrations help usergroup when the Go SDK
+# validation step fails during an OpenAPI spec release.
+#
+# The caller keys this notification to the "go-sdk-validation" step outcome, so
+# a failure in an earlier setup step (Node, npm, artifact download, Spectral,
+# Go) does not notify. The caller also suppresses duplicates across release
+# retries.
+
+set -eou pipefail
+
+: "${SLACK_BEARER_TOKEN:?SLACK_BEARER_TOKEN is required}"
+: "${SLACK_CHANNEL_ID:?SLACK_CHANNEL_ID is required}"
+: "${SLACK_HELP_GROUP:?SLACK_HELP_GROUP is required}"
+: "${TARGET_ENV:?TARGET_ENV is required}"
+: "${RUN_URL:?RUN_URL is required}"
+
+SLACK_MESSAGE=$(
+  cat <<EOF
+:rotating_light: The Go SDK validation step failed while validating the OpenAPI spec for the ${TARGET_ENV} environment.
+${SLACK_HELP_GROUP} can you take a look? This can be caused by the input spec or by the atlas-sdk-go tooling, so please triage before assuming a root cause.
+Run: ${RUN_URL}
+EOF
+)
+
+PAYLOAD=$(jq -n \
+  --arg channel "${SLACK_CHANNEL_ID}" \
+  --arg text "${SLACK_MESSAGE}" \
+  '{channel: $channel, text: $text}')
+
+SLACK_RESPONSE=$(curl --silent --show-error \
+  --request POST \
+  --header "Authorization: Bearer ${SLACK_BEARER_TOKEN}" \
+  --header "Content-type: application/json; charset=utf-8" \
+  --data "${PAYLOAD}" \
+  https://slack.com/api/chat.postMessage)
+
+SLACK_OK=$(echo "${SLACK_RESPONSE}" | jq -r '.ok')
+if [ "${SLACK_OK}" != "true" ]; then
+  SLACK_ERROR=$(echo "${SLACK_RESPONSE}" | jq -r '.error')
+  echo "Failed to send the Slack notification: ${SLACK_ERROR}"
+  if [ "${SLACK_ERROR}" == "not_in_channel" ]; then
+    echo "The Slack bot is not a member of channel ${SLACK_CHANNEL_ID}."
+    echo "Invite the bot to the channel or update SLACK_CHANNEL_ID."
+  fi
+  exit 1
+fi
+
+echo "Slack notification sent to ${SLACK_CHANNEL_ID}."
diff --git a/.github/workflows/release-spec-runner.yml b/.github/workflows/release-spec-runner.yml
index 1b64c39218..7889d3c779 100644
--- a/.github/workflows/release-spec-runner.yml
+++ b/.github/workflows/release-spec-runner.yml
@@ -58,6 +58,7 @@ jobs:
       api_bot_pat: ${{ secrets.API_BOT_PAT }}
       jira_api_token: ${{ secrets.JIRA_API_TOKEN }}
       bump_token: ${{secrets.BUMP_TOKEN}}
+      slack_bearer_token: ${{ secrets.SLACK_BEARER_TOKEN }}
     with:
       aws_default_region: ${{ vars.AWS_DEFAULT_REGION}}
       aws_s3_bucket: ${{ vars.S3_BUCKET_DEV}}
@@ -78,6 +79,7 @@ jobs:
         api_bot_pat: ${{ secrets.API_BOT_PAT }}
         jira_api_token: ${{ secrets.JIRA_API_TOKEN }}
         bump_token: ${{secrets.BUMP_TOKEN}}
+        slack_bearer_token: ${{ secrets.SLACK_BEARER_TOKEN }}
     with:
         aws_default_region: ${{ vars.AWS_DEFAULT_REGION}}
         aws_s3_role_to_assume: ${{ vars.AWS_S3_ROLE_TO_ASSUME }}
@@ -98,6 +100,7 @@ jobs:
         api_bot_pat: ${{ secrets.API_BOT_PAT }}
         jira_api_token: ${{ secrets.JIRA_API_TOKEN }}
         bump_token: ${{secrets.BUMP_TOKEN}}
+        slack_bearer_token: ${{ secrets.SLACK_BEARER_TOKEN }}
     with:
         aws_default_region: ${{ vars.AWS_DEFAULT_REGION}}
         aws_s3_role_to_assume: ${{ vars.AWS_S3_ROLE_TO_ASSUME }}
@@ -120,6 +123,7 @@ jobs:
         workspace_id: ${{ secrets.WORKSPACE_ID }}
         jira_api_token: ${{ secrets.JIRA_API_TOKEN }}
         bump_token: ${{secrets.BUMP_TOKEN}}
+        slack_bearer_token: ${{ secrets.SLACK_BEARER_TOKEN }}
     with:
         aws_default_region: ${{ vars.AWS_DEFAULT_REGION}}
         aws_s3_role_to_assume: ${{ vars.AWS_S3_ROLE_TO_ASSUME }}
diff --git a/.github/workflows/release-spec.yml b/.github/workflows/release-spec.yml
index f8f48bde6e..500fc54a50 100644
--- a/.github/workflows/release-spec.yml
+++ b/.github/workflows/release-spec.yml
@@ -60,6 +60,8 @@ on:
         required: false
       bump_token:
         required: true
+      slack_bearer_token:
+        required: true
 
 permissions:
   contents: write
@@ -86,6 +88,7 @@ jobs:
     uses: ./.github/workflows/required-spec-validations.yml
     secrets:
       api_bot_pat: ${{ secrets.api_bot_pat }}
+      slack_bearer_token: ${{ secrets.slack_bearer_token }}
     with:
       env: ${{ inputs.env }}
 
diff --git a/.github/workflows/required-spec-validations.yml b/.github/workflows/required-spec-validations.yml
index 084223da6a..5dee7bc603 100644
--- a/.github/workflows/required-spec-validations.yml
+++ b/.github/workflows/required-spec-validations.yml
@@ -9,6 +9,8 @@ on:
     secrets: # all secrets are passed explicitly in this workflow
       api_bot_pat:
         required: true
+      slack_bearer_token:
+        required: true
 permissions:
   contents: write
 
@@ -74,3 +76,26 @@ jobs:
             pushd atlas-sdk-go
             make -e openapi-pipeline
             popd
+        # Notify the APIx DevOps Integrations on-call so an SDK validation
+        # failure is routed quickly. Keyed to the go-sdk-validation step
+        # outcome: an earlier setup failure (Node, npm, artifact download,
+        # Spectral, Go, SDK checkout) leaves this step without a failure
+        # outcome, so it does not notify.
+        - name: Notify the Go SDK validation failure
+          # Notify once per incident. The release retry handler requests a
+          # rerun of failed jobs while github.run_attempt < 3, so attempt 3 is
+          # the first attempt after the automatic retries are exhausted.
+          # Attempts beyond 3 come from reruns the handler already queued and
+          # would duplicate the alert.
+          if: ${{ failure() && steps.go-sdk-validation.outcome == 'failure' && fromJSON(github.run_attempt) == 3 }}
+          env:
+            SLACK_BEARER_TOKEN: ${{ secrets.slack_bearer_token }}
+            # #cloud-apix-devops-integrations-notifications and
+            # @apix-devops-integrations-help (S0C2KP6E273). These are
+            # non-sensitive IDs, kept inline because only the repo owner can
+            # manage repository secrets.
+            SLACK_CHANNEL_ID: C06Q7QF1ZST
+            SLACK_HELP_GROUP: '<!subteam^S0C2KP6E273>'
+            TARGET_ENV: ${{ inputs.env }}
+            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          run: .github/scripts/notify_sdk_validation_failure.sh

From e70295071020e5450806d8930c74985071f4d92d Mon Sep 17 00:00:00 2001
From: Leo Antoli <leo.antoli@mongodb.com>
Date: Wed, 14 Oct 2026 13:04:10 +0200
Subject: [PATCH 2/2] ci: Fix the release failure handler duplicate-issue check

Correct the duplicate-issue query (an extra brace after the environment made it (dev}) instead of (dev)) and replace the top-level return statements with exit. A run step cannot return, so the step exited 2 and failed the job whenever an open failed-release issue already existed.
---
 .github/workflows/failure-handler.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/failure-handler.yml b/.github/workflows/failure-handler.yml
index a6d94bd7a8..f2981cd515 100644
--- a/.github/workflows/failure-handler.yml
+++ b/.github/workflows/failure-handler.yml
@@ -41,19 +41,19 @@ jobs:
                 RELEASE_NAME: ${{ inputs.release_name }}
                 REPO: ${{ github.repository }}
               run: |
-                query="(${TARGET_ENV}}) The ${RELEASE_NAME} Release has failed."
+                query="(${TARGET_ENV}) The ${RELEASE_NAME} Release has failed."
                 number_issue=$(gh search issues "${query}" --repo "${REPO}" --state open --label failed-release --json title | jq length)
                 
                 if [ -z "${number_issue}" ]; then
                     echo "There was an issue with the GH APIs. Stopping execution."
-                    return 1
+                    exit 1
                 fi
                 
                 echo "number_issue=${number_issue}"
                 if [ "${number_issue}" -gt 0 ]; then
                     echo "An issue already exists. Stopping execution."
                     echo "found-issue=true" >> "${GITHUB_OUTPUT}"
-                    return 0
+                    exit 0
                 fi
                 
                 echo "found-issue=false" >> "${GITHUB_OUTPUT}"