Update the script the pings on main branch fails #850

New issue

Open

opened 2026-08-16 01:37:14 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-08-16 01:37:14 +00:00

Owner

Drop job, ref, sha

and the run URL needs to be the public URL

Example from the deploy repo

CI failed on main
repo: coilyco-bridge/deploy
workflow: deploy-lunch-money-mcp
job: rollout
ref: refs/heads/main
sha: 0bd7a30d5c2b466373c7936e2781a2620a318411
run: http://forgejo.forgejo.svc.cluster.local/coilyco-bridge/deploy/actions/runs/20930

Also I would sincerely prefer if the script wasn't copy pasted everywhere

Drop job, ref, sha and the run URL needs to be the public URL Example from the deploy repo --- CI failed on main repo: coilyco-bridge/deploy workflow: deploy-lunch-money-mcp job: rollout ref: refs/heads/main sha: 0bd7a30d5c2b466373c7936e2781a2620a318411 run: http://forgejo.forgejo.svc.cluster.local/coilyco-bridge/deploy/actions/runs/20930 --- Also I would sincerely prefer if the script wasn't copy pasted everywhere

coilyco-ops commented

2026-08-16 05:53:10 +00:00

Owner

#852 does the first two asks and one you did not ask for. It does not do the third.

Format. Now exactly three lines. job, ref and sha are gone.

coilyco-flight-deck/infrastructure CI failing
workflow: lint
run: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/311

Public run URL. The link came from GITHUB_SERVER_URL, which is the cluster-local name the runner registered against, which is why yours read http://forgejo.forgejo.svc.cluster.local/.... It now comes from the forge ROOT_URL.

Not asked for, but adjacent: the step no longer passes BOT_TOKEN or CHAT_ID. deploy#339 had gated that on the signoz-telegram mapper being reachable, and it is now, so no repo holds a Telegram credential.

The copy-paste ask is not solved

Also I would sincerely prefer if the script wasn't copy pasted everywhere

Honest status: still copy-pasted. The roller installs the same file into every repo. #852 makes the copies converge byte-for-byte and gives the roller the ability to update them all from one source, which is strictly better than the drift today, but it is deduplication of content, not of the file.

One shared file is a real fork in the design and worth your call rather than my guess:

A cross-repo composite action. This is what agentic-os/actions/telegram-alert@ was. The org migration left that ref dead and the fleet was deliberately moved off it, so this means re-adopting the pattern that already broke once.
No script at all. The mapper is a plain HTTP endpoint and the payload is now three lines, so the step could be one curl. That deletes the file everywhere instead of sharing it. Costs: interpolating ${{ github.* }} into a shell string is a script-injection surface, JSON-escaping newlines in shell is fragile, and aos#989 banned inline bodies for reasons that partly still apply.
Keep the roller as the single source. One authored file, N generated copies, converged on every run. What #852 gives you.

I would take 3 now and revisit 2 if the copies annoy you in practice, but this is your preference to set, not mine.

Leaving this issue open for that decision. The format and URL half is in #852.

#852 does the first two asks and one you did not ask for. It does not do the third. **Format.** Now exactly three lines. `job`, `ref` and `sha` are gone. ``` coilyco-flight-deck/infrastructure CI failing workflow: lint run: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/311 ``` **Public run URL.** The link came from `GITHUB_SERVER_URL`, which is the cluster-local name the runner registered against, which is why yours read `http://forgejo.forgejo.svc.cluster.local/...`. It now comes from the forge `ROOT_URL`. **Not asked for, but adjacent:** the step no longer passes `BOT_TOKEN` or `CHAT_ID`. `deploy#339` had gated that on the signoz-telegram mapper being reachable, and it is now, so no repo holds a Telegram credential. ## The copy-paste ask is not solved > Also I would sincerely prefer if the script wasn't copy pasted everywhere Honest status: still copy-pasted. The roller installs the same file into every repo. #852 makes the copies converge byte-for-byte and gives the roller the ability to update them all from one source, which is strictly better than the drift today, but it is deduplication of *content*, not of *the file*. One shared file is a real fork in the design and worth your call rather than my guess: 1. **A cross-repo composite action.** This is what `agentic-os/actions/telegram-alert@` was. The org migration left that ref dead and the fleet was deliberately moved off it, so this means re-adopting the pattern that already broke once. 2. **No script at all.** The mapper is a plain HTTP endpoint and the payload is now three lines, so the step could be one `curl`. That deletes the file everywhere instead of sharing it. Costs: interpolating `${{ github.* }}` into a shell string is a script-injection surface, JSON-escaping newlines in shell is fragile, and `aos#989` banned inline bodies for reasons that partly still apply. 3. **Keep the roller as the single source.** One authored file, N generated copies, converged on every run. What #852 gives you. I would take 3 now and revisit 2 if the copies annoy you in practice, but this is your preference to set, not mine. Leaving this issue open for that decision. The format and URL half is in #852.

coilyco-ops commented

2026-08-16 06:06:59 +00:00

Owner

Kai proposed a fourth option that beats all three above, and it is built: put the alert in aosguard.

coilyco-flight-deck/agentic-os#1093 adds aosguard ops telegram alert. The step becomes one verb with no arguments, and no repository carries an alert program at all. That is the copy-paste ask solved outright rather than mitigated.

- name: Alert Telegram on main failure
  if: ${{ failure() && github.ref == 'refs/heads/main' }}
  continue-on-error: true
  run: aosguard ops telegram alert

It works because the program is embedded in the binary and the leaf is sealed, the same shape as forgejo-storage measure. Verified against a local capture server, so nothing was sent to Telegram.

Four implementations disappear once consumers migrate: this repo's scripts/actions/alert-telegram.py, deploy's copy, agentic-os-kai's copy, and agentic-os's local actions/telegram-alert composite action.

One place it does not reach. 29 of the fleet's 31 alerting workflows set container: agentic-os:release and already have aosguard. The exceptions are deploy/reconcile.yml and deploy/compose-review-roles.yml, both on the deploy:host executor, where steps run in the runner pod rather than that image. Those two either keep a script or the runner pod gains the binary, which is a separate call.

#852 is still worth landing. It is independent of this, it fixes the message format and retires the Telegram secrets on the current shape, and that shape is what the two host-executor workflows keep using either way. Migrating call sites to the verb has to wait for a released image regardless.

Kai proposed a fourth option that beats all three above, and it is built: put the alert in aosguard. `coilyco-flight-deck/agentic-os#1093` adds `aosguard ops telegram alert`. The step becomes one verb with no arguments, and **no repository carries an alert program at all**. That is the copy-paste ask solved outright rather than mitigated. ```yaml - name: Alert Telegram on main failure if: ${{ failure() && github.ref == 'refs/heads/main' }} continue-on-error: true run: aosguard ops telegram alert ``` It works because the program is embedded in the binary and the leaf is `sealed`, the same shape as `forgejo-storage measure`. Verified against a local capture server, so nothing was sent to Telegram. Four implementations disappear once consumers migrate: this repo's `scripts/actions/alert-telegram.py`, `deploy`'s copy, `agentic-os-kai`'s copy, and agentic-os's local `actions/telegram-alert` composite action. **One place it does not reach.** 29 of the fleet's 31 alerting workflows set `container: agentic-os:release` and already have aosguard. The exceptions are `deploy/reconcile.yml` and `deploy/compose-review-roles.yml`, both on the `deploy:host` executor, where steps run in the runner pod rather than that image. Those two either keep a script or the runner pod gains the binary, which is a separate call. **#852 is still worth landing.** It is independent of this, it fixes the message format and retires the Telegram secrets on the current shape, and that shape is what the two host-executor workflows keep using either way. Migrating call sites to the verb has to wait for a released image regardless.

coilyco-ops added the

role/platform

role/sysadmin

priority

labels

2026-08-25 08:02:08 +00:00

coilyco-ops added the

autonomy

headless

label

2026-08-25 09:30:28 +00:00

coilyco-ops added this to the CI and repo hygiene milestone