tenant.openagents/omega

1name: Slack Notify First Responders
2
3on:
4  issues:
5    types: [labeled]
6
7permissions:
8  contents: read
9
10env:
11  SEVERITY_LABELS: '["severity:S0", "severity:S1"]'
12  REPRODUCIBLE_LABEL: 'state:reproducible'
13  REACH_LABELS: '["reach:all users", "reach:many users"]'
14  MARKER_REACTION: 'eyes'
15
16jobs:
17  notify-slack:
18    if: github.repository_owner == 'zed-industries' && github.event.issue.state == 'open'
19    runs-on: namespace-profile-2x4-ubuntu-2404
20    permissions:
21      contents: read
22      # For the issue reaction used to dedupe notifications.
23      issues: write
24    # Serialize per issue so the reaction claim below can't race.
25    concurrency:
26      group: slack-notify-first-responders-${{ github.event.issue.number }}
27      cancel-in-progress: false
28
29    steps:
30      - name: Check label combination and claim the notification
31        id: check-label
32        env:
33          GH_TOKEN: ${{ github.token }}
34          GH_REPO: ${{ github.repository }}
35          LABEL_NAME: ${{ github.event.label.name }}
36          ISSUE_NUMBER: ${{ github.event.issue.number }}
37        run: |
38          set -euo pipefail
39
40          api() {
41            curl -sS \
42              -H "Authorization: Bearer $GH_TOKEN" \
43              -H "Accept: application/vnd.github+json" \
44              -H "X-GitHub-Api-Version: 2022-11-28" \
45              "$@"
46          }
47
48          # Ignore labels outside the trifecta so unrelated later edits don't re-fire.
49          TRIGGER_LABELS=$(jq -cn \
50            --argjson severity "$SEVERITY_LABELS" \
51            --arg repro "$REPRODUCIBLE_LABEL" \
52            --argjson reach "$REACH_LABELS" \
53            '$severity + [$repro] + $reach')
54
55          if ! echo "$TRIGGER_LABELS" | jq -e --arg l "$LABEL_NAME" 'index($l) != null' > /dev/null; then
56            echo "Added label '$LABEL_NAME' is not in the trigger set, skipping"
57            echo "should_notify=false" >> "$GITHUB_OUTPUT"
58            exit 0
59          fi
60
61          # The webhook's issue.labels snapshot is racy under bulk apply; read live.
62          ISSUE_LABELS_JSON=$(api -f "https://api.github.com/repos/$GH_REPO/issues/$ISSUE_NUMBER/labels?per_page=100" | jq '[.[].name]')
63
64          MATCHED_SEVERITY=$(echo "$ISSUE_LABELS_JSON" | jq -r --argjson severity "$SEVERITY_LABELS" 'map(select(. as $x | $severity | index($x) != null)) | first // ""')
65          HAS_REPRO=$(echo "$ISSUE_LABELS_JSON" | jq --arg l "$REPRODUCIBLE_LABEL" 'index($l) != null')
66          HAS_REACH=$(echo "$ISSUE_LABELS_JSON" | jq --argjson reach "$REACH_LABELS" 'any(.[]; . as $x | $reach | index($x) != null)')
67
68          if [ -z "$MATCHED_SEVERITY" ] || [ "$HAS_REPRO" != "true" ] || [ "$HAS_REACH" != "true" ]; then
69            echo "Combination not yet satisfied (severity=$MATCHED_SEVERITY, reproducible=$HAS_REPRO, reach=$HAS_REACH), skipping"
70            echo "should_notify=false" >> "$GITHUB_OUTPUT"
71            exit 0
72          fi
73
74          # A bulk label apply emits one `labeled` event per label, so several
75          # runs reach this point. Creating the reaction is our atomic claim:
76          # one run gets 201 and notifies, the rest get 200. It's scoped to our
77          # own reaction, so a human's reaction can't suppress it.
78          REACTION_PAYLOAD=$(jq -cn --arg content "$MARKER_REACTION" '{content: $content}')
79          REACTION_RESPONSE=$(api -w "\n%{http_code}" -X POST \
80            "https://api.github.com/repos/$GH_REPO/issues/$ISSUE_NUMBER/reactions" \
81            -d "$REACTION_PAYLOAD")
82          REACTION_BODY=$(echo "$REACTION_RESPONSE" | sed '$d')
83          REACTION_STATUS=$(echo "$REACTION_RESPONSE" | tail -n1)
84
85          if [ "$REACTION_STATUS" = "200" ]; then
86            echo "First responders already notified for this issue (reaction present), skipping"
87            echo "should_notify=false" >> "$GITHUB_OUTPUT"
88            exit 0
89          fi
90
91          if [ "$REACTION_STATUS" != "201" ]; then
92            echo "::error::Unexpected status $REACTION_STATUS creating reaction: $REACTION_BODY"
93            exit 1
94          fi
95
96          REACTION_ID=$(echo "$REACTION_BODY" | jq -r '.id')
97          LABELS=$(echo "$ISSUE_LABELS_JSON" | jq -r 'join(", ")')
98
99          echo "Confirmed high-reach $MATCHED_SEVERITY, notifying"
100          {
101            echo "notify_reason=confirmed $MATCHED_SEVERITY"
102            echo "issue_labels=$LABELS"
103            echo "reaction_id=$REACTION_ID"
104            echo "should_notify=true"
105          } >> "$GITHUB_OUTPUT"
106
107      - name: Build Slack message payload
108        if: steps.check-label.outputs.should_notify == 'true'
109        env:
110          ISSUE_TITLE: ${{ github.event.issue.title }}
111          ISSUE_URL: ${{ github.event.issue.html_url }}
112          LABELED_BY: ${{ github.event.sender.login }}
113          NOTIFY_REASON: ${{ steps.check-label.outputs.notify_reason }}
114          LABELS: ${{ steps.check-label.outputs.issue_labels }}
115        run: |
116          jq -n \
117            --arg notify_reason "$NOTIFY_REASON" \
118            --arg issue_title "$ISSUE_TITLE" \
119            --arg issue_url "$ISSUE_URL" \
120            --arg labeled_by "$LABELED_BY" \
121            --arg labels "$LABELS" \
122            '{
123              "blocks": [
124                {
125                  "type": "section",
126                  "text": {
127                    "type": "mrkdwn",
128                    "text": "<!subteam^S096CPUUGLF> New *\($notify_reason)* issue"
129                  }
130                },
131                {
132                  "type": "section",
133                  "fields": [
134                    {
135                      "type": "mrkdwn",
136                      "text": "*Issue:*\n<\($issue_url)|\($issue_title)>"
137                    },
138                    {
139                      "type": "mrkdwn",
140                      "text": "*Labeled by:*\n\($labeled_by)"
141                    },
142                    {
143                      "type": "mrkdwn",
144                      "text": "*Labels:*\n\($labels)"
145                    }
146                  ]
147                }
148              ]
149            }' > payload.json
150
151          echo "Payload built successfully:"
152          cat payload.json
153
154      - name: Send Slack notification
155        if: steps.check-label.outputs.should_notify == 'true'
156        env:
157          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_FIRST_RESPONDERS }}
158          GH_TOKEN: ${{ github.token }}
159          GH_REPO: ${{ github.repository }}
160          ISSUE_NUMBER: ${{ github.event.issue.number }}
161          REACTION_ID: ${{ steps.check-label.outputs.reaction_id }}
162        run: |
163          set -uo pipefail
164
165          release_claim() {
166            if [ -n "${REACTION_ID:-}" ]; then
167              echo "Releasing reaction claim so the notification can be retried"
168              curl -sS -X DELETE \
169                -H "Authorization: Bearer $GH_TOKEN" \
170                -H "Accept: application/vnd.github+json" \
171                -H "X-GitHub-Api-Version: 2022-11-28" \
172                "https://api.github.com/repos/$GH_REPO/issues/$ISSUE_NUMBER/reactions/$REACTION_ID" || true
173            fi
174          }
175
176          if [ -z "$SLACK_WEBHOOK_URL" ]; then
177            echo "::error::SLACK_WEBHOOK_FIRST_RESPONDERS secret is not set"
178            release_claim
179            exit 1
180          fi
181
182          HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "$SLACK_WEBHOOK_URL" \
183            -H "Content-Type: application/json" \
184            -d @payload.json)
185
186          HTTP_BODY=$(echo "$HTTP_RESPONSE" | sed '$d')
187          HTTP_STATUS=$(echo "$HTTP_RESPONSE" | tail -n 1)
188
189          echo "Slack API response status: $HTTP_STATUS"
190          echo "Slack API response body: $HTTP_BODY"
191
192          if [ "$HTTP_STATUS" -ne 200 ]; then
193            echo "::error::Slack notification failed with status $HTTP_STATUS: $HTTP_BODY"
194            release_claim
195            exit 1
196          fi
197
198          echo "Slack notification sent successfully"
199