ci: a failing scheduled run notifies nobody #540

New issue

Open

opened 2026-09-17 02:46:56 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-17 02:46:56 +00:00

Owner

The daily drift.yml cron exists to catch regressions that appear without the code changing. When it catches one, nothing happens.

The repository has no webhooks configured. A failed scheduled run produces a red row in the Actions tab and no other signal: no webhook delivery, no notification, no issue, no message anywhere.

Demonstrated

The git-matrix job merged on 2026-09-17 and failed on its first run at 15:15 local. It would have failed every morning indefinitely. It was found only because someone went looking at the Actions list for an unrelated reason. Nothing surfaced it.

Why this matters more than it looks

govulncheck is the one job on that cron whose answer genuinely changes without a commit: the vulnerability database moves under a static commit, which is exactly why it runs scheduled rather than only on push. That is a security check, and its result is delivered to nobody.

A scheduled check with no delivery path is a log entry, not a safety net. It is arguably worse than no check, because its presence suggests the question is being watched.

Ask

Give a failing scheduled run somewhere to go. Options worth weighing rather than a prescribed design:

A webhook to something that is actually read.
Open or update an issue on failure, so the tracker carries it and it cannot be missed. This has the advantage of needing no infrastructure beyond the forge itself.
Forgejo's own notification settings, if a scheduled-run failure can be made to reach a watcher.

Whatever it is, it should distinguish "the scheduled run failed" from the ordinary noise of a PR going red, since the whole point is that nobody is looking at the time.

Acceptance

A failing scheduled run produces a signal that reaches a person without anyone opening the Actions tab.
A run that fails on consecutive days does not produce a new alert every day.
Deliberately failing a scheduled run demonstrates the path end to end before this closes.

Related: #538 covers the fact that surface-diff on the same cron is deterministic and cannot detect anything today, so it currently contributes nothing worth alerting on.

The daily `drift.yml` cron exists to catch regressions that appear without the code changing. When it catches one, nothing happens. The repository has **no webhooks configured**. A failed scheduled run produces a red row in the Actions tab and no other signal: no webhook delivery, no notification, no issue, no message anywhere. ## Demonstrated The `git-matrix` job merged on 2026-09-17 and failed on its first run at 15:15 local. It would have failed every morning indefinitely. It was found only because someone went looking at the Actions list for an unrelated reason. Nothing surfaced it. ## Why this matters more than it looks `govulncheck` is the one job on that cron whose answer genuinely changes without a commit: the vulnerability database moves under a static commit, which is exactly why it runs scheduled rather than only on push. That is a security check, and its result is delivered to nobody. A scheduled check with no delivery path is a log entry, not a safety net. It is arguably worse than no check, because its presence suggests the question is being watched. ## Ask Give a failing scheduled run somewhere to go. Options worth weighing rather than a prescribed design: * A webhook to something that is actually read. * Open or update an issue on failure, so the tracker carries it and it cannot be missed. This has the advantage of needing no infrastructure beyond the forge itself. * Forgejo's own notification settings, if a scheduled-run failure can be made to reach a watcher. Whatever it is, it should distinguish "the scheduled run failed" from the ordinary noise of a PR going red, since the whole point is that nobody is looking at the time. ## Acceptance * A failing scheduled run produces a signal that reaches a person without anyone opening the Actions tab. * A run that fails on consecutive days does not produce a new alert every day. * Deliberately failing a scheduled run demonstrates the path end to end before this closes. Related: #538 covers the fact that `surface-diff` on the same cron is deterministic and cannot detect anything today, so it currently contributes nothing worth alerting on.

hexajon added the

bug

label

2026-09-17 02:46:56 +00:00

hexajon referenced this issue

2026-09-17 03:06:00 +00:00

ci: the forgejo-smoke job has never run #542

hexajon referenced this issue

2026-09-17 05:51:01 +00:00

Epic: madtea's external contracts are asserted, not verified #544

hexajon added a new dependency

2026-09-17 05:51:05 +00:00