ci(notify): deliver CI results to Matrix SMK GitOps instead of the retiring ntfy #3

2026-10-04T16:41:00-05:00

larry commented

2026-10-04 16:41:00 -05:00

The estate is retiring ntfy (t_2ebc094c). This repo's CI notified through
ntfy.internal/gitops-ci, which after the retirement returns nothing while the notify job
still exits 0 (|| echo "Notification failed (non-blocking)"). This PR moves the CI result
to the Matrix room SMK GitOps (!DrRjRvgbqDgZsVHiZP:smkfam.com) through the estate's webhook gateway, the same
mechanism the alert tier routes use (decision t_78e4920f / PR #368).

Destination, proved end-to-end before this PR was opened (`t_6f081a70`)

POST http://hermes2.internal:8644/webhooks/gitops-ci   (X-Gitlab-Token, in-estate)
  negative control: no token -> 401 {"error": "Invalid signature"}
  with token      : 200 {"status": "delivered", "route": "gitops-ci", "target": "matrix", ...}
gateway log: [webhook] direct-deliver route=gitops-ci target=matrix msg_len=69
room read-back: $IJSZM_0cvSxbviuVzm3YwfAEDTQGRp3u-NfAswtB9d0
                @hermes:smkfam.com  m.room.encrypted  m.megolm.v1.aes-sha2

Before

  NTFY_URL: http://ntfy.internal

After

  GITOPS_NOTIFY_URL: http://hermes2.internal:8644/webhooks/gitops-ci

The notification is now loud: a non-2xx from the gateway fails the notify job instead of
printing a line and exiting 0. The gateway answers 502 when the target delivery fails, so
the result is meaningful rather than "curl ran".

Card: t_6f081a70 (maintenance lane). Rollout: one PR per repo, no shared template to fix
(the 50 ci.yml files are 18 distinct shapes, not byte-identical copies).

The estate is retiring ntfy (`t_2ebc094c`). This repo's CI notified through `ntfy.internal/gitops-ci`, which after the retirement returns nothing while the notify job still exits 0 (`|| echo "Notification failed (non-blocking)"`). This PR moves the CI result to the Matrix room **SMK GitOps** (`!DrRjRvgbqDgZsVHiZP:smkfam.com`) through the estate's webhook gateway, the same mechanism the alert tier routes use (decision `t_78e4920f` / PR #368). ### Destination, proved end-to-end before this PR was opened (`t_6f081a70`) ``` POST http://hermes2.internal:8644/webhooks/gitops-ci (X-Gitlab-Token, in-estate) negative control: no token -> 401 {"error": "Invalid signature"} with token : 200 {"status": "delivered", "route": "gitops-ci", "target": "matrix", ...} gateway log: [webhook] direct-deliver route=gitops-ci target=matrix msg_len=69 room read-back: $IJSZM_0cvSxbviuVzm3YwfAEDTQGRp3u-NfAswtB9d0 @hermes:smkfam.com m.room.encrypted m.megolm.v1.aes-sha2 ``` ### Before ```yaml NTFY_URL: http://ntfy.internal ``` ### After ```yaml GITOPS_NOTIFY_URL: http://hermes2.internal:8644/webhooks/gitops-ci ``` The notification is now **loud**: a non-2xx from the gateway fails the notify job instead of printing a line and exiting 0. The gateway answers `502` when the target delivery fails, so the result is meaningful rather than "curl ran". Card: `t_6f081a70` (maintenance lane). Rollout: one PR per repo, no shared template to fix (the 50 `ci.yml` files are 18 distinct shapes, not byte-identical copies).

larry added 1 commit 2026-10-04 16:41:00 -05:00

ci: notify through the Matrix SMK GitOps webhook route instead of ntfy

CI / validate (pull_request) Successful in 5s

Details

8d60e636da

CI / validate (pull_request) Successful in 5s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin ci/gitops-notify-t_6f081a70:ci/gitops-notify-t_6f081a70

git checkout ci/gitops-notify-t_6f081a70

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: larry/hermes-deployment#3

ci(notify): deliver CI results to Matrix SMK GitOps instead of the retiring ntfy #3

Destination, proved end-to-end before this PR was opened (t_6f081a70)

Before

After

Checkout

Destination, proved end-to-end before this PR was opened (`t_6f081a70`)