ci: post Slack notices with the bot token

.github/workflows/notify-slack-on-main-merge.yml

@@ -0,0 +1,37 @@
+name: Notify Slack on Merge to Main
+
+# pull_request_target runs this file from main with secrets, so merged PRs from
+# forks post too. Nothing from the PR is checked out or run; the title only
+# reaches the shell through an env var.
+on:
+  pull_request_target:
+    types: [closed]
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true && vars.SLACK_CHANNEL_ID != ''
+    steps:
+      # Slack reads <, > and & as markup: escape them so a PR title cannot
+      # mention @channel or rewrite the link.
+      - name: Escape the PR title for Slack
+        id: pr
+        env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          printf 'title=%s\n' "$(printf '%s' "$TITLE" | tr '\r\n' '  ' | sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g')" >> "$GITHUB_OUTPUT"
+
+      - name: Send notification to Slack
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          # toJSON quotes the title, so quotes and colons in it keep the payload valid.
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: ${{ toJSON(format('[Codeplain Client] PR <{0}|#{1}: {2}> was merged to main by `{3}`.', github.event.pull_request.html_url, github.event.pull_request.number, steps.pr.outputs.title, github.actor)) }}

.github/workflows/publish-dev-to-pypi.yml

@@ -110,9 +110,6 @@ jobs:
       # authenticate this run — no long-lived API token needed.
       id-token: write
 
-    env:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-
     steps:
       - name: Download distribution packages
         uses: actions/download-artifact@v8
@@ -127,21 +124,57 @@ jobs:
           # version should be a no-op, not a red build.
           skip-existing: true
 
-      - name: Notify Slack (success)
-        if: ${{ success() && env.SLACK_WEBHOOK_URL != '' }}
-        env:
-          VERSION: ${{ needs.build.outputs.version }}
-        run: |
-          # Spell out the --pre install: a plain "pip install codeplain" will
-          # NOT pick this up, which otherwise reads as a broken publish.
-          TEXT="*Codeplain Client*: dev build \`$VERSION\` published to PyPI :test_tube:. Normal installs are unaffected — try it with \`pip install --pre codeplain==$VERSION\`. Pre-release builds talk to \`api.test.codeplain.ai\` by default."
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "$(jq -n --arg t "$TEXT" '{text:$t}')"
+  # End-of-run notices run in their own job: a failed Slack post fails only this
+  # job, not the publish or its GitHub deployment, and "Re-run failed jobs"
+  # re-posts without publishing again.
+  notify:
+    name: Notify Slack
+    needs: [build, publish-dev]
+    if: ${{ !cancelled() && vars.SLACK_CHANNEL_ID != '' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Short SHA
+        run: echo "SHORT_SHA=${GITHUB_SHA:0:7}" >> "$GITHUB_ENV"
+
+      - name: Notify Slack (build failure)
+        if: ${{ needs.build.result == 'failure' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Building the dev build FAILED :x: (commit `${{ env.SHORT_SHA }}`). Nothing was published to PyPI.
+              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
 
       - name: Notify Slack (failure)
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "{\"text\":\"*Codeplain Client*: Publishing dev build to PyPI FAILED :x: (commit \`${{ github.sha }}\`). See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"
+        if: ${{ needs.publish-dev.result == 'failure' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Publishing dev build to PyPI FAILED :x: (commit `${{ env.SHORT_SHA }}`).
+              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
+
+      # Spell out the --pre install: a plain "pip install codeplain" will
+      # NOT pick this up, which otherwise reads as a broken publish.
+      - name: Notify Slack (success)
+        if: ${{ needs.publish-dev.result == 'success' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: dev build `${{ needs.build.outputs.version }}` published to PyPI :test_tube:.
+              Normal installs are unaffected — try it with `pip install --pre codeplain==${{ needs.build.outputs.version }}`.
+              Pre-release builds talk to `api.test.codeplain.ai` by default.

.github/workflows/publish-install-script.yml

@@ -14,9 +14,6 @@ jobs:
     name: Upload to Cloudflare R2
     runs-on: ubuntu-latest
 
-    env:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -57,17 +54,43 @@ jobs:
             --content-type "text/plain"
           echo "✓ examples.ps1 uploaded to R2"
 
-      - name: Notify Slack (success)
-        if: ${{ success() && env.SLACK_WEBHOOK_URL != '' }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "{\"text\":\"*Codeplain Client*: Install scripts deployed to R2 :white_check_mark: (\`${GITHUB_SHA:0:7}\`, by *${{ github.actor }}*).\"}"
+  # End-of-run notices run in their own job: a failed Slack post fails only this
+  # job, and "Re-run failed jobs" re-posts without uploading again.
+  notify:
+    name: Notify Slack
+    needs: publish
+    if: ${{ !cancelled() && vars.SLACK_CHANNEL_ID != '' }}
+    runs-on: ubuntu-latest
+    permissions: {}
+
+    steps:
+      - name: Short SHA
+        run: echo "SHORT_SHA=${GITHUB_SHA:0:7}" >> "$GITHUB_ENV"
 
       - name: Notify Slack (failure)
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "{\"text\":\"*Codeplain Client*: Install script deploy to R2 FAILED :x: (\`${GITHUB_SHA:0:7}\`). Users may be getting a stale installer. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"
+        if: ${{ needs.publish.result == 'failure' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Install script deploy to R2 FAILED :x: (`${{ env.SHORT_SHA }}`).
+              Users may be getting a stale installer.
+              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
+
+      - name: Notify Slack (success)
+        if: ${{ needs.publish.result == 'success' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Install scripts deployed to R2 :white_check_mark:
+              (`${{ env.SHORT_SHA }}`, by *${{ github.actor }}*).