From 34028aea891fdd1c8fe424fed6e0e792a92c1f14 Mon Sep 17 00:00:00 2001 From: Pieter Noordhuis Date: Tue, 3 Nov 2026 14:09:00 +0100 Subject: [PATCH 1/8] Open an issue when the vulnerable-dependency bumper fails Co-authored-by: Isaac --- .github/workflows/bump-vuln-deps.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml index 05fd08a6d6c..6f4fbc44254 100644 --- a/.github/workflows/bump-vuln-deps.yml +++ b/.github/workflows/bump-vuln-deps.yml @@ -10,6 +10,9 @@ permissions: contents: write pull-requests: write + # Required to open or comment on the failure-tracking issue. + issues: write + # Required by setup-jfrog (GOPROXY exchange). id-token: write @@ -120,3 +123,28 @@ jobs: -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \ commit -m "Add changelog fragment" git push origin "HEAD:$BRANCH" + + # A failed scheduled run is otherwise only visible in the Actions tab. + # Track failures in a single open issue: open it on the first failure and + # comment on it for every subsequent one until someone closes it. + - name: Report failure + if: failure() + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + run: |- + label="bump-vuln-deps-failure" + gh label create "$label" --force \ + --color B60205 \ + --description "The Bump vulnerable dependencies workflow is failing" + issue="$(gh issue list --label "$label" --state open --json number --jq '.[0].number // empty')" + if [ -n "$issue" ]; then + gh issue comment "$issue" --body "Failed again: $RUN_URL" + else + gh issue create --label "$label" \ + --title "Bump vulnerable dependencies workflow is failing" \ + --body "@databricks/eng-deco-cli the scheduled \`Bump vulnerable dependencies\` workflow failed: $RUN_URL + + Dependencies with known vulnerabilities are not being bumped until this is fixed. Subsequent failures are added as comments; close this issue once the workflow is fixed." + fi From 075fdc4d37331d6297f7e6e730ae1bbc12003993 Mon Sep 17 00:00:00 2001 From: Pieter Noordhuis Date: Tue, 3 Nov 2026 14:09:01 +0100 Subject: [PATCH 2/8] TEMPORARY: simulate a failure to test the Report failure step Co-authored-by: Isaac --- .github/workflows/bump-vuln-deps.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml index 6f4fbc44254..c4ac0029005 100644 --- a/.github/workflows/bump-vuln-deps.yml +++ b/.github/workflows/bump-vuln-deps.yml @@ -26,6 +26,10 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # TEMPORARY: force a failure to exercise the Report failure step. Revert before merging. + - name: Simulate failure + run: exit 1 + - name: Setup JFrog uses: ./.github/actions/setup-jfrog From 081896664a28d7168677895209229f12e3c4f0fe Mon Sep 17 00:00:00 2001 From: Pieter Noordhuis Date: Tue, 3 Nov 2026 14:11:45 +0100 Subject: [PATCH 3/8] Revert simulated failure used to test the Report failure step Co-authored-by: Isaac --- .github/workflows/bump-vuln-deps.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml index c4ac0029005..6f4fbc44254 100644 --- a/.github/workflows/bump-vuln-deps.yml +++ b/.github/workflows/bump-vuln-deps.yml @@ -26,10 +26,6 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - # TEMPORARY: force a failure to exercise the Report failure step. Revert before merging. - - name: Simulate failure - run: exit 1 - - name: Setup JFrog uses: ./.github/actions/setup-jfrog From b6df9c60e0e8769f5acb4f7de319b7735492a6c6 Mon Sep 17 00:00:00 2001 From: Pieter Noordhuis Date: Tue, 3 Nov 2026 14:18:56 +0100 Subject: [PATCH 4/8] Put the failed run link on its own line in the failure issue Co-authored-by: Isaac --- .github/workflows/bump-vuln-deps.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml index 6f4fbc44254..e8bf87a23be 100644 --- a/.github/workflows/bump-vuln-deps.yml +++ b/.github/workflows/bump-vuln-deps.yml @@ -144,7 +144,7 @@ jobs: else gh issue create --label "$label" \ --title "Bump vulnerable dependencies workflow is failing" \ - --body "@databricks/eng-deco-cli the scheduled \`Bump vulnerable dependencies\` workflow failed: $RUN_URL + --body "@databricks/eng-deco-cli the scheduled \`Bump vulnerable dependencies\` workflow failed. - Dependencies with known vulnerabilities are not being bumped until this is fixed. Subsequent failures are added as comments; close this issue once the workflow is fixed." + $RUN_URL" fi From e377778091eed8f20687160b7a8ad0a1d3825323 Mon Sep 17 00:00:00 2001 From: Pieter Noordhuis Date: Tue, 3 Nov 2026 14:21:21 +0100 Subject: [PATCH 5/8] Share the failure reporter with the Go toolchain bumper Move the Report failure step into a composite action and use it from both scheduled bump workflows. Co-authored-by: Isaac --- .github/actions/report-failure/action.yml | 38 +++++++++++++++++++++++ .github/workflows/bump-go-toolchain.yml | 10 ++++++ .github/workflows/bump-vuln-deps.yml | 24 ++------------ 3 files changed, 51 insertions(+), 21 deletions(-) create mode 100644 .github/actions/report-failure/action.yml diff --git a/.github/actions/report-failure/action.yml b/.github/actions/report-failure/action.yml new file mode 100644 index 00000000000..0231eb0c23c --- /dev/null +++ b/.github/actions/report-failure/action.yml @@ -0,0 +1,38 @@ +name: 'Report failure' +description: >- + Track failures of a scheduled workflow in a single open issue: open it on the + first failure and comment on it for every subsequent one until someone closes + it. Run this as the last step with "if: failure()". + Requires the calling job to have "permissions: issues: write". + +inputs: + label: + description: Label that identifies the failure-tracking issue for this workflow. + required: true + +runs: + using: 'composite' + steps: + - name: Open or update failure issue + shell: bash + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + LABEL: ${{ inputs.label }} + WORKFLOW: ${{ github.workflow }} + RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + run: |- + set -euo pipefail + gh label create "$LABEL" --force \ + --color B60205 \ + --description "The $WORKFLOW workflow is failing" + issue="$(gh issue list --label "$LABEL" --state open --json number --jq '.[0].number // empty')" + if [ -n "$issue" ]; then + gh issue comment "$issue" --body "Failed again: $RUN_URL" + else + gh issue create --label "$LABEL" \ + --title "$WORKFLOW workflow is failing" \ + --body "@databricks/eng-deco-cli the scheduled \`$WORKFLOW\` workflow failed. + + $RUN_URL" + fi diff --git a/.github/workflows/bump-go-toolchain.yml b/.github/workflows/bump-go-toolchain.yml index eee8d4afb57..c624c0a6563 100644 --- a/.github/workflows/bump-go-toolchain.yml +++ b/.github/workflows/bump-go-toolchain.yml @@ -16,6 +16,9 @@ permissions: contents: write pull-requests: write + # Required to open or comment on the failure-tracking issue. + issues: write + jobs: bump-go-toolchain: runs-on: @@ -125,3 +128,10 @@ jobs: -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \ commit -m "Add changelog fragment" git push origin "HEAD:$BRANCH" + + # A failed scheduled run is otherwise only visible in the Actions tab. + - name: Report failure + if: failure() + uses: ./.github/actions/report-failure + with: + label: bump-go-toolchain-failure diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml index e8bf87a23be..cebec39454b 100644 --- a/.github/workflows/bump-vuln-deps.yml +++ b/.github/workflows/bump-vuln-deps.yml @@ -125,26 +125,8 @@ jobs: git push origin "HEAD:$BRANCH" # A failed scheduled run is otherwise only visible in the Actions tab. - # Track failures in a single open issue: open it on the first failure and - # comment on it for every subsequent one until someone closes it. - name: Report failure if: failure() - env: - GH_TOKEN: ${{ github.token }} - GH_REPO: ${{ github.repository }} - RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} - run: |- - label="bump-vuln-deps-failure" - gh label create "$label" --force \ - --color B60205 \ - --description "The Bump vulnerable dependencies workflow is failing" - issue="$(gh issue list --label "$label" --state open --json number --jq '.[0].number // empty')" - if [ -n "$issue" ]; then - gh issue comment "$issue" --body "Failed again: $RUN_URL" - else - gh issue create --label "$label" \ - --title "Bump vulnerable dependencies workflow is failing" \ - --body "@databricks/eng-deco-cli the scheduled \`Bump vulnerable dependencies\` workflow failed. - - $RUN_URL" - fi + uses: ./.github/actions/report-failure + with: + label: bump-vuln-deps-failure From 554f6807fa8ceaa630c186bebf1024c1e3ebe63b Mon Sep 17 00:00:00 2001 From: Pieter Noordhuis Date: Tue, 3 Nov 2026 14:30:46 +0100 Subject: [PATCH 6/8] Assign failure issues to the bump workflows' reviewers A team mention posted by github-actions did not notify the team's members. Co-authored-by: Isaac --- .github/actions/report-failure/action.yml | 7 +++++++ .github/workflows/bump-go-toolchain.yml | 1 + .github/workflows/bump-vuln-deps.yml | 1 + 3 files changed, 9 insertions(+) diff --git a/.github/actions/report-failure/action.yml b/.github/actions/report-failure/action.yml index 0231eb0c23c..ef63226e162 100644 --- a/.github/actions/report-failure/action.yml +++ b/.github/actions/report-failure/action.yml @@ -9,6 +9,9 @@ inputs: label: description: Label that identifies the failure-tracking issue for this workflow. required: true + assignees: + description: Comma-separated GitHub users to assign to a newly opened issue. + required: true runs: using: 'composite' @@ -19,6 +22,7 @@ runs: GH_TOKEN: ${{ github.token }} GH_REPO: ${{ github.repository }} LABEL: ${{ inputs.label }} + ASSIGNEES: ${{ inputs.assignees }} WORKFLOW: ${{ github.workflow }} RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} run: |- @@ -30,7 +34,10 @@ runs: if [ -n "$issue" ]; then gh issue comment "$issue" --body "Failed again: $RUN_URL" else + # Assign individuals: a team mention posted by github-actions does not + # notify the team's members. gh issue create --label "$LABEL" \ + --assignee "$ASSIGNEES" \ --title "$WORKFLOW workflow is failing" \ --body "@databricks/eng-deco-cli the scheduled \`$WORKFLOW\` workflow failed. diff --git a/.github/workflows/bump-go-toolchain.yml b/.github/workflows/bump-go-toolchain.yml index c624c0a6563..9e3c0ee8602 100644 --- a/.github/workflows/bump-go-toolchain.yml +++ b/.github/workflows/bump-go-toolchain.yml @@ -135,3 +135,4 @@ jobs: uses: ./.github/actions/report-failure with: label: bump-go-toolchain-failure + assignees: simonfaltum,andrewnester,anton-107,denik,janniklasrose,pietern,shreyas-goenka diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml index cebec39454b..bb8f6affcca 100644 --- a/.github/workflows/bump-vuln-deps.yml +++ b/.github/workflows/bump-vuln-deps.yml @@ -130,3 +130,4 @@ jobs: uses: ./.github/actions/report-failure with: label: bump-vuln-deps-failure + assignees: simonfaltum,andrewnester,anton-107,denik,janniklasrose,pietern,shreyas-goenka From 0fc567dec1bbb928cbea7a2195bf305123abbcb1 Mon Sep 17 00:00:00 2001 From: Pieter Noordhuis Date: Tue, 3 Nov 2026 14:30:46 +0100 Subject: [PATCH 7/8] TEMPORARY: simulate a failure to test the Report failure step Co-authored-by: Isaac --- .github/workflows/bump-vuln-deps.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml index bb8f6affcca..64656881d3b 100644 --- a/.github/workflows/bump-vuln-deps.yml +++ b/.github/workflows/bump-vuln-deps.yml @@ -26,6 +26,10 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # TEMPORARY: force a failure to exercise the Report failure step. Revert before merging. + - name: Simulate failure + run: exit 1 + - name: Setup JFrog uses: ./.github/actions/setup-jfrog From c56b0a0947156cc1b47154aa9619413f264d581a Mon Sep 17 00:00:00 2001 From: Pieter Noordhuis Date: Tue, 3 Nov 2026 14:31:47 +0100 Subject: [PATCH 8/8] Revert simulated failure used to test the Report failure step Co-authored-by: Isaac --- .github/workflows/bump-vuln-deps.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml index 64656881d3b..bb8f6affcca 100644 --- a/.github/workflows/bump-vuln-deps.yml +++ b/.github/workflows/bump-vuln-deps.yml @@ -26,10 +26,6 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - # TEMPORARY: force a failure to exercise the Report failure step. Revert before merging. - - name: Simulate failure - run: exit 1 - - name: Setup JFrog uses: ./.github/actions/setup-jfrog