From a7cff6898d729290a2ca721d43f7a2a122ed0db6 Mon Sep 17 00:00:00 2001
From: Johannes <johannes@bcos.cloud>
Date: Tue, 14 Jul 2026 14:58:12 -0400
Subject: [PATCH] ci: post a #hiveops-dev-deploy card when cd-develop finishes

cd-develop built and pushed the image, then said nothing. With no Slack step and
no Gitea webhook, the only way to know a build ran was to poll the Actions API
(whose run status is unreliable) or list registry tags. 21 of 24 repos were silent
this way; only devices, guide and incident notified.

Ports the notify step from hiveops-devices verbatim, adapted for a build-only
pipeline: the card says built & pushed (not deployed) and names the tag to deploy.

if: always() so failures are announced too, and continue-on-error so a Slack hiccup
can never fail a build. Short SHA is derived inside the step from github.sha, as most
repos have no Short SHA step. No new secret: SLACK_WEBHOOK_URL is already an org secret.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitea/workflows/cd-develop.yml | 34 +++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/.gitea/workflows/cd-develop.yml b/.gitea/workflows/cd-develop.yml
index d043d5b..4d5493e 100644
--- a/.gitea/workflows/cd-develop.yml
+++ b/.gitea/workflows/cd-develop.yml
@@ -103,3 +103,37 @@ jobs:
             -u ${{ secrets.DEV_REGISTRY_USERNAME }} --password-stdin
           docker build -t ${{ secrets.DEV_REGISTRY_URL }}/hiveiq-aria:dev .
           docker push ${{ secrets.DEV_REGISTRY_URL }}/hiveiq-aria:dev
+
+      # Posts a ✅/🔴 card to #hiveops-dev-deploy on every run, so a build is never silent.
+      # if: always() → failures are announced too. continue-on-error → a notify hiccup must
+      # NEVER fail the build. SLACK_WEBHOOK_URL is an org secret; unset → the step no-ops.
+      - name: Notify Slack (#hiveops-dev-deploy)
+        if: always()
+        continue-on-error: true
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          JOB_STATUS: ${{ job.status }}
+          ACTOR: ${{ github.actor }}
+          REF_NAME: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+          RUN_NUMBER: ${{ github.run_number }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          COMMIT_MSG: ${{ github.event.head_commit.message }}
+        run: |
+          [ -z "$SLACK_WEBHOOK_URL" ] && { echo "no SLACK_WEBHOOK_URL secret — skipping"; exit 0; }
+          SHORT="${SHA:0:8}"
+          FIRST="${COMMIT_MSG%%$'\n'*}"
+          SUBJECT="$(printf '%s' "$FIRST" | tr -d '"\\' | cut -c1-100)"
+          if [ "$JOB_STATUS" = "success" ]; then
+            COLOR="#2eb67d"
+            TITLE=":white_check_mark: aria — cd-develop OK · image built & pushed"
+            NEXT="*Not deployed* — this pipeline only builds. Deploy \`:dev\` to bcos.dev (.251) when ready."
+          else
+            COLOR="#e01e5a"
+            TITLE=":red_circle: aria — cd-develop FAILED ($JOB_STATUS)"
+            NEXT="The image may not have been pushed — check the run before deploying anything."
+          fi
+          PAYLOAD=$(printf '{"attachments":[{"color":"%s","blocks":[{"type":"section","text":{"type":"mrkdwn","text":"*%s*"}},{"type":"section","fields":[{"type":"mrkdwn","text":"*Commit*\\n`%s` %s"},{"type":"mrkdwn","text":"*Tags*\\n`:dev`"},{"type":"mrkdwn","text":"*By*\\n%s"},{"type":"mrkdwn","text":"*Run*\\n#%s"}]},{"type":"section","text":{"type":"mrkdwn","text":"*Next*\\n%s"}},{"type":"actions","elements":[{"type":"button","text":{"type":"plain_text","text":"View run"},"url":"%s"}]}]}]}' \
+            "$COLOR" "$TITLE" "$SHORT" "$SUBJECT" "$ACTOR" "$RUN_NUMBER" "$NEXT" "$RUN_URL")
+          code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 -X POST -H 'Content-type: application/json' --data "$PAYLOAD" "$SLACK_WEBHOOK_URL" || echo "curl-error")
+          echo "slack notify HTTP: $code (200 = card posted)"