ci: move notify-failure to workflow_run to hide from PR checks

Author: gmarzot

.github/workflows/ci.yml

@@ -56,53 +56,3 @@ jobs:
           path: ${{ matrix.build_dir }}/test-results.xml
           reporter: java-junit
 
-  notify-failure:
-    runs-on: ubuntu-22.04
-    needs: [build]
-    if: failure()
-    steps:
-      - name: Notify Slack
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ github.token }}
-          SLACK_WEBHOOK_URL: ${{ secrets.OMOQ_SLACK_WEBHOOK_URL }}
-        run: |
-          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            # First-failure-only: skip if previous run on this branch also failed
-            PREV=$(gh api \
-              "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?branch=${{ github.head_ref }}&event=pull_request&per_page=2" \
-              --jq '.workflow_runs[1].conclusion // "none"' 2>/dev/null) || PREV="none"
-            if [ "$PREV" = "failure" ]; then
-              echo "Previous run also failed — skipping"
-              exit 0
-            fi
-            TEXT=":x: *${{ github.repository }}* \`${{ github.head_ref }}\` failed — <${{ github.event.pull_request.html_url }}|PR #${{ github.event.pull_request.number }}> · <${RUN_URL}|run> · <${{ github.event.pull_request.html_url }}/checks|tests>"
-          else
-            SHORT="${GITHUB_SHA:0:12}"
-            TEXT=":x: *${{ github.repository }}* \`${{ github.ref_name }}\` \`${SHORT}\` — build failed · <${RUN_URL}|run>"
-          fi
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H "Content-Type: application/json" \
-            --data "{\"text\": \"${TEXT}\"}"
-
-      - name: Notify email (main only)
-        if: github.event_name == 'push'
-        continue-on-error: true
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.OMOQ_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.OMOQ_AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: us-east-1
-        run: |
-          SHORT="${GITHUB_SHA:0:12}"
-          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-          REPO_NAME="${{ github.event.repository.name }}"
-          SUBJECT="[${REPO_NAME}] build FAILED ${{ github.ref_name }} ${SHORT}"
-          BODY="${{ github.repository }} · ${{ github.ref_name }} · ${SHORT}\n${RUN_URL}"
-          aws ses send-email \
-            --from "noreply@ci.openmoq.org" \
-            --destination '{"ToAddresses":["github-notifications@openmoq.org"]}' \
-            --message "{
-              \"Subject\": {\"Data\": \"$SUBJECT\"},
-              \"Body\": {\"Text\": {\"Data\": \"$BODY\"}}
-            }"

.github/workflows/notify-ci-failure.yml

@@ -0,0 +1,44 @@
+name: notify ci failure
+
+# Fires after the build workflow completes — invisible to PR checks.
+# Push-to-main failures are handled by the publish release workflow.
+
+on:
+  workflow_run:
+    workflows: ["build"]
+    types: [completed]
+
+permissions:
+  contents: read
+
+jobs:
+  notify:
+    if: |
+      github.event.workflow_run.conclusion == 'failure' &&
+      github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Notify Slack (first failure only)
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SLACK_WEBHOOK_URL: ${{ secrets.OMOQ_SLACK_WEBHOOK_URL }}
+        run: |
+          BRANCH="${{ github.event.workflow_run.head_branch }}"
+          RUN_URL="${{ github.event.workflow_run.html_url }}"
+          PR_NUMBER=$(echo '${{ toJSON(github.event.workflow_run.pull_requests) }}' | jq -r '.[0].number // empty')
+          PR_URL="${{ github.server_url }}/${{ github.repository }}/pull/${PR_NUMBER}"
+
+          # First-failure-only: skip if previous run on this branch also failed
+          PREV=$(gh api \
+            "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?branch=${BRANCH}&event=pull_request&per_page=2" \
+            --jq '.workflow_runs[1].conclusion // "none"' 2>/dev/null) || PREV="none"
+          if [ "$PREV" = "failure" ]; then
+            echo "Previous run also failed — skipping"
+            exit 0
+          fi
+
+          TEXT=":x: *${{ github.repository }}* \`${BRANCH}\` failed — <${PR_URL}|PR #${PR_NUMBER}> · <${RUN_URL}|run> · <${PR_URL}/checks|tests>"
+          curl -s -X POST "$SLACK_WEBHOOK_URL" \
+            -H "Content-Type: application/json" \
+            --data "{\"text\": \"${TEXT}\"}"