feat: add dependabot-notify reusable workflow - #14
Open
xnoto wants to merge 1 commit into
Open
Conversation
Posts a synthetic alert to the cluster Grafana's embedded Alertmanager API when a caller repo's pull_request actor is dependabot[bot]. Callers are managed centrally by tfroot-github; requires the Cloudflare Access service token and GRAFANA_ALERTS_TOKEN secrets distributed there.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Reusable workflow that posts a synthetic alert to the cluster Grafana's embedded Alertmanager API (
POST /api/alertmanager/grafana/api/v1/alerts) when Dependabot opens a PR. Part of the Dependabot PR alerting pipeline (Discord delivery).Details
GITHUB_TOKENpermissions (permissions: {}); the PR payload is read from$GITHUB_EVENT_PATH.alertname=DependabotPR,severity=info,repository. Annotations carry PR number, title, and URL;generatorURLlinks back to the PR.curl -f+set -euo pipefail: delivery failures fail the job visibly in the caller repo's Actions tab.CLOUDFLARE_AUTH_CLIENT_ID/CLOUDFLARE_AUTH_CLIENT_SECRET(existing GitHub Actions Access service token) andGRAFANA_ALERTS_TOKENin caller repos — distributed by tfroot-github (stacked PR).Merge order
First. Callers reference
@main, so this must merge before the tfroot-github alerting PR takes effect.Validation
pre-commit run: actionlint, gitleaks, and all file hooks pass.