From 28445f38e3200b7e7366766e3184f655abd8b6c5 Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Thu, 9 Jul 2026 18:11:46 -0700 Subject: [PATCH 1/5] Rename reusable-workflow-notification to workflow-failure-issue and add consumer docs --- .github/CODEOWNERS | 8 ++- .github/workflows/pull-request-dashboard.yml | 2 +- ...ication.yml => workflow-failure-issue.yml} | 7 ++- README.md | 1 + workflow-failure-issue/README.md | 50 +++++++++++++++++++ 5 files changed, 61 insertions(+), 7 deletions(-) rename .github/workflows/{reusable-workflow-notification.yml => workflow-failure-issue.yml} (89%) create mode 100644 workflow-failure-issue/README.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index ca7aec4cd..d51645ed1 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -6,9 +6,13 @@ * @open-telemetry/shared-workflows-approvers -# Unlike typical shared workflows, the pull request dashboard workflow runs entirely -# in this repository. +# Pull request dashboard +pull-request-dashboard/** @open-telemetry/shared-workflows-approvers @trask .github/scripts/pull-request-dashboard/** @open-telemetry/shared-workflows-approvers @trask .github/workflows/pull-request-dashboard.yml @open-telemetry/shared-workflows-approvers @trask .github/workflows/pull-request-dashboard-repo.yml @open-telemetry/shared-workflows-approvers @trask .github/workflows/pull-request-dashboard-deploy-webhook.yml @open-telemetry/shared-workflows-approvers @trask + +# Workflow failure issue +workflow-failure-issue/** @open-telemetry/shared-workflows-approvers @trask +.github/workflows/workflow-failure-issue.yml @open-telemetry/shared-workflows-approvers @trask diff --git a/.github/workflows/pull-request-dashboard.yml b/.github/workflows/pull-request-dashboard.yml index 970379413..27e7a54c3 100644 --- a/.github/workflows/pull-request-dashboard.yml +++ b/.github/workflows/pull-request-dashboard.yml @@ -229,7 +229,7 @@ jobs: permissions: contents: read issues: write # needed to open/close the hourly failure tracking issue - uses: ./.github/workflows/reusable-workflow-notification.yml + uses: ./.github/workflows/workflow-failure-issue.yml with: # A superseded per-repo publish is cancelled (publish-dashboard uses # cancel-in-progress: true), so count cancelled as success here to avoid diff --git a/.github/workflows/reusable-workflow-notification.yml b/.github/workflows/workflow-failure-issue.yml similarity index 89% rename from .github/workflows/reusable-workflow-notification.yml rename to .github/workflows/workflow-failure-issue.yml index 497c27ec3..962f17a98 100644 --- a/.github/workflows/reusable-workflow-notification.yml +++ b/.github/workflows/workflow-failure-issue.yml @@ -1,6 +1,5 @@ -# this is useful because notifications for scheduled workflows are only sent to the user who -# initially created the given workflow -name: Reusable - Workflow notification +# Reusable workflow — see /workflow-failure-issue/README.md for consumer documentation. +name: Workflow failure issue on: workflow_call: @@ -13,7 +12,7 @@ permissions: contents: read jobs: - workflow-notification: + workflow-failure-issue: name: Open or close workflow failure issue permissions: contents: read diff --git a/README.md b/README.md index c12f92cd6..dc4f77388 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,7 @@ See [`CONTRIBUTING.md`](./CONTRIBUTING.md) for how to propose a new shared workf | [First-time contributor](./first-time-pr/) | Reusable workflow that welcomes first-time contributors on `pull_request_target: opened`: applies a label and posts a customizable welcome comment. | Call via `uses:` from your repo's `pull_request_target` workflow. See the [First-time contributor README](./first-time-pr/README.md) for the snippet. | | [Pull Request Dashboard](./pull-request-dashboard/) | Centrally-executed workflow that builds a per-repository pull request triage dashboard (issue body, status, Slack notifications) for opted-in repositories. | Add your repository to [`repositories.json`](./.github/scripts/pull-request-dashboard/repositories.json) and follow the setup in the [workflow's README](./pull-request-dashboard/README.md). | | [Survey on merged PR](./survey-on-merged-pr/) | Reusable workflow that posts a survey link to a merged PR when the author is a new contributor. | Call via `uses:` from your repo's `pull_request_target: closed` workflow. See the [Survey on merged PR README](./survey-on-merged-pr/README.md) for the snippet. | +| [Workflow failure issue](./workflow-failure-issue/) | Reusable workflow that tracks a workflow's pass/fail state by opening, commenting on, and closing a GitHub issue in the calling repository — useful for scheduled workflows whose failure notifications only reach their original author. | Call via `uses:` from a final `if: always()` job in the workflow you want to monitor. See the [Workflow failure issue README](./workflow-failure-issue/README.md) for the snippet. | | [Zizmor](./zizmor/) | Static analysis of GitHub Actions workflows for security issues using [zizmor](https://github.com/zizmorcore/zizmor). | Call via `uses:` from your repo's workflow. See the [Zizmor README](./zizmor/README.md) for the snippet. | ## Maintainers diff --git a/workflow-failure-issue/README.md b/workflow-failure-issue/README.md new file mode 100644 index 000000000..9f30e37e1 --- /dev/null +++ b/workflow-failure-issue/README.md @@ -0,0 +1,50 @@ +# Workflow failure issue + +Reusable GitHub Actions workflow that tracks the pass/fail state of another +workflow (typically a scheduled one) by opening, commenting on, and closing a +GitHub issue in the calling repository. + +This is useful because GitHub only sends scheduled-workflow failure +notifications to the user who initially created the workflow. By opening a +tracking issue instead, the whole team is notified. + +Behavior: + +- On failure, if no tracking issue is open, a new issue titled + `Workflow failed: (#)` is created. +- On a subsequent failure while an issue is already open, a comment linking to + the failing run is added. +- On success, any open tracking issue is closed. + +## How to use + +Add a final job to the workflow you want to monitor. It must run after the jobs +you care about, use `if: always()` so it also runs when they fail, and grant +`issues: write`: + +```yaml +permissions: + contents: read + +jobs: + # ... your jobs (e.g. build) ... + + workflow-failure-issue: + permissions: + contents: read + issues: write + needs: + - build + if: always() + uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@ + with: + success: ${{ needs.build.result == 'success' }} +``` + +Pin `` to a commit SHA or release tag in this repository. + +### Inputs + +| Name | Type | Required | Description | +| ---- | ---- | -------- | ----------- | +| `success` | boolean | yes | Whether the monitored jobs succeeded. Pass `true` to close any open tracking issue, `false` to open or comment on one. | From 93a7af495db1b22e1511b4c38a41998524749075 Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Thu, 9 Jul 2026 18:40:04 -0700 Subject: [PATCH 2/5] Remove unused checkout; set GH_REPO so gh works without a local checkout --- .github/workflows/workflow-failure-issue.yml | 6 +----- workflow-failure-issue/README.md | 1 - 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/.github/workflows/workflow-failure-issue.yml b/.github/workflows/workflow-failure-issue.yml index 962f17a98..7109a08a6 100644 --- a/.github/workflows/workflow-failure-issue.yml +++ b/.github/workflows/workflow-failure-issue.yml @@ -15,17 +15,13 @@ jobs: workflow-failure-issue: name: Open or close workflow failure issue permissions: - contents: read issues: write # needed to open, comment on, and close workflow failure issues runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - persist-credentials: false - - name: Open issue or add comment if issue already open env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPO: ${{ github.repository }} INPUT_SUCCESS: ${{ inputs.success }} run: | set -euo pipefail diff --git a/workflow-failure-issue/README.md b/workflow-failure-issue/README.md index 9f30e37e1..887833764 100644 --- a/workflow-failure-issue/README.md +++ b/workflow-failure-issue/README.md @@ -31,7 +31,6 @@ jobs: workflow-failure-issue: permissions: - contents: read issues: write needs: - build From 3fd4be389571702f5d57c363a03264e27a150de6 Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Thu, 9 Jul 2026 19:38:55 -0700 Subject: [PATCH 3/5] Correct scheduled-workflow notification recipient wording with GitHub docs quote --- README.md | 2 +- workflow-failure-issue/README.md | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index dc4f77388..ea134b917 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ See [`CONTRIBUTING.md`](./CONTRIBUTING.md) for how to propose a new shared workf | [First-time contributor](./first-time-pr/) | Reusable workflow that welcomes first-time contributors on `pull_request_target: opened`: applies a label and posts a customizable welcome comment. | Call via `uses:` from your repo's `pull_request_target` workflow. See the [First-time contributor README](./first-time-pr/README.md) for the snippet. | | [Pull Request Dashboard](./pull-request-dashboard/) | Centrally-executed workflow that builds a per-repository pull request triage dashboard (issue body, status, Slack notifications) for opted-in repositories. | Add your repository to [`repositories.json`](./.github/scripts/pull-request-dashboard/repositories.json) and follow the setup in the [workflow's README](./pull-request-dashboard/README.md). | | [Survey on merged PR](./survey-on-merged-pr/) | Reusable workflow that posts a survey link to a merged PR when the author is a new contributor. | Call via `uses:` from your repo's `pull_request_target: closed` workflow. See the [Survey on merged PR README](./survey-on-merged-pr/README.md) for the snippet. | -| [Workflow failure issue](./workflow-failure-issue/) | Reusable workflow that tracks a workflow's pass/fail state by opening, commenting on, and closing a GitHub issue in the calling repository — useful for scheduled workflows whose failure notifications only reach their original author. | Call via `uses:` from a final `if: always()` job in the workflow you want to monitor. See the [Workflow failure issue README](./workflow-failure-issue/README.md) for the snippet. | +| [Workflow failure issue](./workflow-failure-issue/) | Reusable workflow that tracks a workflow's pass/fail state by opening, commenting on, and closing a GitHub issue in the calling repository — useful for scheduled workflows whose failure notifications otherwise reach only a single user. | Call via `uses:` from a final `if: always()` job in the workflow you want to monitor. See the [Workflow failure issue README](./workflow-failure-issue/README.md) for the snippet. | | [Zizmor](./zizmor/) | Static analysis of GitHub Actions workflows for security issues using [zizmor](https://github.com/zizmorcore/zizmor). | Call via `uses:` from your repo's workflow. See the [Zizmor README](./zizmor/README.md) for the snippet. | ## Maintainers diff --git a/workflow-failure-issue/README.md b/workflow-failure-issue/README.md index 887833764..294cffc58 100644 --- a/workflow-failure-issue/README.md +++ b/workflow-failure-issue/README.md @@ -4,9 +4,13 @@ Reusable GitHub Actions workflow that tracks the pass/fail state of another workflow (typically a scheduled one) by opening, commenting on, and closing a GitHub issue in the calling repository. -This is useful because GitHub only sends scheduled-workflow failure -notifications to the user who initially created the workflow. By opening a -tracking issue instead, the whole team is notified. +This is useful because GitHub notifies only a single user of scheduled-workflow +failures. Per the [GitHub docs on scheduled workflows](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#actor-for-scheduled-workflows): + +> Notifications for scheduled workflows are sent to the user who last modified +> the cron syntax in the workflow file. + +By opening a tracking issue instead, the whole team is notified. Behavior: From 6b4423f97c1af50e66b8c1036b2011fded633fb1 Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Thu, 9 Jul 2026 19:49:01 -0700 Subject: [PATCH 4/5] Tighten permissions to least-privilege (drop unneeded contents scope) --- .github/workflows/pull-request-dashboard.yml | 1 - .github/workflows/workflow-failure-issue.yml | 3 +-- workflow-failure-issue/README.md | 3 --- 3 files changed, 1 insertion(+), 6 deletions(-) diff --git a/.github/workflows/pull-request-dashboard.yml b/.github/workflows/pull-request-dashboard.yml index 27e7a54c3..d4d40b70e 100644 --- a/.github/workflows/pull-request-dashboard.yml +++ b/.github/workflows/pull-request-dashboard.yml @@ -227,7 +227,6 @@ jobs: ) ) permissions: - contents: read issues: write # needed to open/close the hourly failure tracking issue uses: ./.github/workflows/workflow-failure-issue.yml with: diff --git a/.github/workflows/workflow-failure-issue.yml b/.github/workflows/workflow-failure-issue.yml index 7109a08a6..dad3602ef 100644 --- a/.github/workflows/workflow-failure-issue.yml +++ b/.github/workflows/workflow-failure-issue.yml @@ -8,8 +8,7 @@ on: type: boolean required: true -permissions: - contents: read +permissions: {} jobs: workflow-failure-issue: diff --git a/workflow-failure-issue/README.md b/workflow-failure-issue/README.md index 294cffc58..565f8639a 100644 --- a/workflow-failure-issue/README.md +++ b/workflow-failure-issue/README.md @@ -27,9 +27,6 @@ you care about, use `if: always()` so it also runs when they fail, and grant `issues: write`: ```yaml -permissions: - contents: read - jobs: # ... your jobs (e.g. build) ... From 5e99d348f04238256ed431134e0f45a92276965c Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Thu, 9 Jul 2026 20:22:24 -0700 Subject: [PATCH 5/5] Clarify tracking issue makes failures team-visible, not auto-notified --- workflow-failure-issue/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/workflow-failure-issue/README.md b/workflow-failure-issue/README.md index 565f8639a..31ce4675b 100644 --- a/workflow-failure-issue/README.md +++ b/workflow-failure-issue/README.md @@ -10,7 +10,7 @@ failures. Per the [GitHub docs on scheduled workflows](https://docs.github.com/e > Notifications for scheduled workflows are sent to the user who last modified > the cron syntax in the workflow file. -By opening a tracking issue instead, the whole team is notified. +By opening a tracking issue instead, the failure is visible to the whole team. Behavior: