CI failure alerts never reach Telegram: the alert step exits 2 on a missing secret #45

New issue

Open

opened 2026-08-29 15:08:28 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-08-29 15:08:28 +00:00

Owner

Every job in .forgejo/workflows/build-publish.yml carries an "Alert Telegram on main failure" step that runs scripts/ci/telegram-alert.py. On run 74 (the ruff-format failure on main, commit 56caa9c) that step logged:

telegram alert missing required secret
Failed to execute step (but continue-on-error is true): exitcode '2': failure

The script returns 2 when BOT_TOKEN or CHAT_ID is empty. TELEGRAM_BOT_TOKEN and TELEGRAM_RED_CHAT_ID are not set as Actions secrets on this repository, so the branch that returns 2 is the only one that has ever run. The step is continue-on-error: true, so it never failed a job, and the silence looks identical to a healthy CI.

So: main has failed at least once with nobody notified. Observed on run 74; I have not checked whether earlier failing runs (65, 62) hit the same branch.

What is needed is setting the two Actions secrets on coilyco-flight-deck/lunch-money-k8s. That is a live-surface change on Forgejo rather than a code change here, which is why this is filed rather than fixed. The token values live in SSM; data/ssm-index.md in agentic-os-kai is the index to search for the Telegram entries.

Worth deciding at the same time: whether an alert step that cannot alert should stay continue-on-error, or fail loudly so a missing secret is visible on the first run rather than on the first outage.

Found while fixing the run-74 format failure (ea739b6).

Every job in `.forgejo/workflows/build-publish.yml` carries an "Alert Telegram on main failure" step that runs `scripts/ci/telegram-alert.py`. On run 74 (the ruff-format failure on main, commit 56caa9c) that step logged: telegram alert missing required secret Failed to execute step (but continue-on-error is true): exitcode '2': failure The script returns 2 when `BOT_TOKEN` or `CHAT_ID` is empty. `TELEGRAM_BOT_TOKEN` and `TELEGRAM_RED_CHAT_ID` are not set as Actions secrets on this repository, so the branch that returns 2 is the only one that has ever run. The step is `continue-on-error: true`, so it never failed a job, and the silence looks identical to a healthy CI. So: main has failed at least once with nobody notified. Observed on run 74; I have not checked whether earlier failing runs (65, 62) hit the same branch. What is needed is setting the two Actions secrets on `coilyco-flight-deck/lunch-money-k8s`. That is a live-surface change on Forgejo rather than a code change here, which is why this is filed rather than fixed. The token values live in SSM; `data/ssm-index.md` in agentic-os-kai is the index to search for the Telegram entries. Worth deciding at the same time: whether an alert step that cannot alert should stay `continue-on-error`, or fail loudly so a missing secret is visible on the first run rather than on the first outage. Found while fixing the run-74 format failure (ea739b6).

coilyco-ops added the

autonomy

headless

priority

labels

2026-08-29 15:08:29 +00:00

coilyco-ops commented

2026-08-29 16:03:31 +00:00

Author

Owner

This is fleet-wide rather than specific to this repo. Confirmed the identical telegram alert missing required secret on coilyco-gaming/galaxy-gen run 155, and 14 repos carry the same alert step across the three orgs.

Tracked centrally at coilysiren/inbox#501, which carries the full list, the SSM parameter names, and why it could not be fixed in place: AOSGuard's Forgejo surface has no secrets verb, so there is nothing to write Actions secrets with. Org-level secrets on the three orgs would cover every repo in three writes.

This is fleet-wide rather than specific to this repo. Confirmed the identical `telegram alert missing required secret` on coilyco-gaming/galaxy-gen run 155, and 14 repos carry the same alert step across the three orgs. Tracked centrally at coilysiren/inbox#501, which carries the full list, the SSM parameter names, and why it could not be fixed in place: AOSGuard's Forgejo surface has no secrets verb, so there is nothing to write Actions secrets with. Org-level secrets on the three orgs would cover every repo in three writes.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/lunch-money-k8s#45

No description provided.

Rows
Columns