Repository navigation
Conversation
The deploy templates put the webhook input in the job env, and every step prints that env in its log. A secret is masked there. The input stays optional, so callers that still pass it keep working. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both deploy templates (
deployment-template.yamlanddeploy-dev-all.yaml) take the Slack webhook as an input and put it in the job env. Every step prints that env in its log, so each deploy log shows the webhook URL. A secret passed to a reusable workflow is masked there instead.What changes
slack_webhook_urlin both templates.SLACK_WEBHOOK_URLin the job env reads the secret, and falls back to theslack_webhook_urlinput when no secret is passed.Checked
actionlintis clean on both templates.actionlintaccepts both the current callers (input) and callers that pass the secret. It reports a misspelled secret name, so the check does see the call.Not checked: a real deploy run. The first deploy whose caller passes the secret should post the usual "deployment started" message, and its log should show
SLACK_WEBHOOK_URL: ***.🤖 Generated with Claude Code