arbourd/concourse-slack-alert-resource

A structured Slack notification resource for Concourse

concourse-slack-alert-resource

A structured and opinionated Slack notification resource for Concourse.

The message is built by using Concourse's resource metadata to show the pipeline, job, build number and a URL.

Installing

Use this resource by adding the following to the resource_types section of a pipeline config:

resource_types:

- name: slack-alert
  type: registry-image
  source:
    repository: ghcr.io/arbourd/concourse-slack-alert-resource

See the Concourse docs for more details on adding resource_types to a pipeline config.

Source Configuration

• url: Required. Slack webhook URL.
• channel: Optional. Target channel where messages are posted. If unset the default channel of the webhook is used.
• concourse_url: Optional. The external URL that points to Concourse. Defaults to the env variable ATC_EXTERNAL_URL.
• username: Optional. Concourse local user (or basic auth) username. Required for non-public pipelines if using alert type fixed or broke
• password: Optional. Concourse local user (or basic auth) password. Required for non-public pipelines if using alert type fixed or broke
• disable: Optional. Disables the resource (does not send notifications). Defaults to false.

Behavior

check: No operation.

in: No operation.

out: Send a message to Slack.

Sends a structured message to Slack based on the alert type.

Parameters

• alert_type: Optional. The type of alert to send to Slack. See Alert Types. Defaults to default.
• channel: Optional. Channel where this message is posted. Defaults to the channel setting in Source.
• channel_file: Optional. File containing text which overrides channel. If the file cannot be read, channel will be used instead.
• message: Optional. The status message at the top of the alert. Defaults to name of alert type.
• message_file: Optional. File containing text which overrides message. If the file cannot be read, message will be used instead.
• text: Optional. Additional text below the message of the alert. Defaults to an empty string.
• text_file: Optional. File containing text which overrides text. If the file cannot be read, text will be used instead.
• color: Optional. The color of the notification bar as a hexadecimal. Defaults to the icon color of the alert type.
• disable: Optional. Disables the alert. Defaults to false.

Alert Types

• default

  

• success

  

• failed

  

• started

  

• aborted

  

• errored

  

• fixed

  Fixed is a special alert type that only alerts if the previous build did not succeed. Fixed requires username and password to be set for the resource if the pipeline is not public.

  

• broke

  Broke is a special alert type that only alerts if the previous build succeed. Broke requires username and password to be set for the resource if the pipeline is not public.

  

Examples

Out

Using the default alert type with custom message and color:

resources:
- name: notify
  type: slack-alert
  source:
    url: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

jobs:
  # ...
  plan:
  - put: notify
    params:
      message: Completed
      color: "#eeeeee"

Using built-in alert types with appropriate build hooks:

resources:
- name: notify
  type: slack-alert
  source:
    url: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

jobs:
  # ...
  plan:
  - put: notify
    params:
      alert_type: started
  - put: some-other-task
    on_success:
      put: notify
      params:
        alert_type: success
    on_failure:
      put: notify
      params:
        alert_type: failed
    on_abort:
      put: notify
      params:
        alert_type: aborted
    on_error:
      put: notify
      params:
        alert_type: errored

Using the fixed alert type:

resources:
- name: notify
  type: slack-alert
  source:
    url: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX
    # `alert_type: fixed` requires Concourse credentials if pipeline is private
    username: concourse
    password: concourse

jobs:
  # ...
  plan:
  - put: some-other-task
    on_success:
      put: notify
      params:
        # will only alert if build was successful and fixed
        alert_type: fixed

concourse-slack-alert-resource's Issues

put command

Hi
I believe there may be an issue with the out command
If you use the following even though a test channel exists it only send the message 'Tmessage' to the default channel

• put: slack
  params:
  text: "TCompleted"
  message: "MCompleted"
  alert_type: success
  color: "#eeeeee"
  channel: "test"

Way to notify specific people on slack

I want to notify certain users only based on the job name that failed. I tried using the message field like this

on_failure:
    put: notify
    params:
      alert_type: failed
      message: "Failed <@UDL2T4MRD>"

Although I can see I have been tagged, slack doesn't notify me ( I have notifications enabled when someone mentions my name.)

Is there a better way to do it?

Return the same version for out operation

Right now, the out operation returns a timestamp as its version (which is inherently different every minute). This creates unnecessary records in the database and volumes (as a put will call get after).

Change the timestamp version to something that does not change.

Add disable function

It would be nice to disable the resource at both a Source and Job param level.

Add tests

Classic Dylan

fixed/broke AUTH not working with oauth2/oidc

Hi,
we're using an oauth2 provider for our authentication of our teams/members.

It seems the authentication for the fixed/broke notifications does not work. We're getting:

2020/01/21 12:22:55 error getting last build status: error connecting to Concourse: oauth2: cannot fetch token: 401 Unauthorized

Response:

Yes: Reponse is empty. Logging says:
{"timestamp":"2020-01-21T12:22:55.008878894Z","level":"error","source":"atc","message":"atc.sky.token.failed-to-fetch-dex-token","data":{"error":"oauth2: cannot fetch token: 401 Unauthorized\nResponse: {\"error\":\"access_denied\",\"error_description\":\"Invalid username or password\"}","session":"7.5653"}} {"timestamp":"2020-01-21T12:22:55.015407688Z","level":"error","source":"atc","message":"atc.sky.token.invalid-basic-auth","data":{"session":"7.5654"}}

Do you have an Idea how to solve that or du debug it better?
Thanks,
Felix

Error Authenticating with Concourse 6.5.0

Since I have updated to Concourse v6.5.1when the slack notification resources is used it fails with message "error getting last build status: error requesting Concourse build status: unexpected status code: 401".

Concourse release v6.5.0 (https://github.com/concourse/concourse/releases/tag/v6.5.0) contained breaking changes; including breaking changes affecting "custom automation built around Concourse that authenticates with the Concourse API".

Is the slack notification resource concourse authentication flow affected by the breaking change and causing the issues I am seeing?

Log build data

During the running of this resource, we should log:

• What the selected alert type is
• If alert type is fixed, log if the build is fixed or not
• When we successfully send a message
• Some response data from sending Slack the message

If available, show the semver as well as the build version of the service

It would be cool to see the version of the service with the build number instead of the concourse build number.

Instead of build number, it would be great to see the semver.buildnumber.

Encountering 'Invalid client credentials' in Concourse 6.0

Hi All,

I was using this excellent concourse resource on a Concourse 5.x deployment, but after moving to a Concourse 6.0.0 deployment, the username / password login when using fixed / broke notifications started failing.

I ensured that I have a local user in the concourse deployment, and has access to the team.

I can login using fly login using local user, however when running in CI I get:

2020/09/11 14:50:36 error getting last build status: error connecting to Concourse: oauth2: cannot fetch token: 401 Unauthorized
Response: {"error":"invalid_client","error_description":"Invalid client credentials."}

I have tried latest tag and tag for when started supporting Concourse v6.0.

I also pulled the code for the project and looked at isolating the call to login using the creds,
and I see where it is failing when doing the oauth Password Credentials call
https://github.com/arbourd/concourse-slack-alert-resource/blob/master/concourse/client.go#L96

I'm not sure if I missed something or if anyone else has encountered this recently?

Note, I could be missing something in the v6 concourse deploy but local user login seems to work fine from the fly CLI

Cheers

Do not send fixed on a new pipeline/job

We're using instanced pipelines to handle PRs and the alert resource sends fixed for every job in the new instance of our pipeline

Per documentation:

Fixed is a special alert type that only alerts if the previous build did not succeed.

Can we change fixed to ignore the unknown state (no previous builds) or at least add a param to ignore new jobs?

Add message/color overrides

Return timestamps in both `in` and `check`

Provide some basic template variable expansion?

Like in the hipchat or other slack resources ( cloudfoundry ) there are usually some interesting variables you would like to see expaneded in the message.

• BUILD_TEAM_NAME
• BUILD_PIPELINE_NAME
• BUILD_JOB_NAME
• BUILD_NAME

One could construct custom links like

/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME

What do you think? Thanks

latest docker image tag is broke

When using the :latest image, it is broken for me:

ailed to pull image arbourd/concourse-slack-alert-resource@sha256:0ae8529b5f9bfd2a0be018b0420e54ed89a16e435a6a510af66f31bc1a7f3415.
resource script '/opt/resource/in [/tmp/build/get]' failed: exit status 1

Are some layers broken or something - not sure how this cold potentially happen. Using :master was no problem though

Allow the ability to create a minimal slack alert

When there are a lot of deployments, the channel it is in gets very noisy. I was wondering if we could add a parameter to allow a minimal alert that might look like this:

The link would be to the corresponding concourse build.

Add disable at Source level as well

Add build running/started alert type

Allow Message to be set by file

Add README.md

Cuz docs are prolly useful

version is missing from previous step

I'm attempting to use this resource to send error notifications to slack whenever a pipeline fails, but doing so results in version is missing from previous step. Am I doing something wrong here?

My pipeline yaml:

---
resource_types:

- name: slack-notifier
  type: docker-image
  source:
    repository: arbourd/concourse-slack-alert-resource
    tag: v0.16.2

resources:

# Other resources here...

- name: notify
  type: slack-notifier
  source:
    url: https://hooks.slack.com/services/... # devops_alerts


jobs:
- name: mfa-iam-report
  plan:
  - task: mfa-iam-report
    config:
      run: exit 1 # This job should fail so that the failure notification should go to slack

    on_failure:
      put: notify
      params:
        alert_type: failed

FWIW, this is my first usage of arbourd/concourse-slack-alert-resource, but not my first usage of a slack notification resource. Previously we used another community resource, but that resource is now unmaintained and so we are switching over to this resource. Previously, we had this other one which also used the slack-notifier name:

resource_types:

- name: slack-notifier
  type: docker-image
  source:
    repository: mockersf/concourse-slack-notifier

I suppose it's possible that there could be some leftover artifact from the old usage in Concourse's database or something, but I did also kill our Concourse server and let its ASG build a new server from scratch, so any cache of Docker images or something should now be gone.

fixed/broke AUTH not working with oauth2

Seeing this when using v0.14.1 of the resource in Concourse 7

error getting last build status: error connecting to Concourse: oauth2: cannot fetch token: 404 Not Found
Response: 404 page not found

Make this project into a generic notification resource type?

Hi,

Recently, my team have to migrate our Concourse notification from Slack to Google Chat. Based on your high quality codes, I can easily implement the notification resource for Google Chat. What do you think of adding an additional backend to concourse-slack-alert-resource? I've already implemented a prototype in https://github.com/higuoxing/concourse-google-chat-alert-resource.

It looks like:

Disabling at source is described in README but not present in latest image on dockerhub

When I add the resource_type:

- name: slack-alert
  type: docker-image
  source:
    repository: arbourd/concourse-slack-alert-resource

Concourse will, by default, pull the image tagged as latest. In this case latest is synonymous with v0.4.0. That release was made on 5th July.

The README describes the ability to set disable: true on source, like so:

- name: slack
  type: slack-alert
  source:
    url: ((slack-inbound-webhook))
    disable: true

But this feature was added in master on 10th July and is only present in the master-tagged image.

My suggestion is to cut a v0.5.0 release, so that the README is in sync with behaviour.

Disable builds for master branch as `latest`

latest should be the latest tag to prevent master branch bugs from bleeding into everyone's slack messages.

Looking for a new maintainer

Hey folks,

I haven't used Concourse for almost 3 years and keeping this up-to-date can be a bit of a problem.

Would anyone who uses this resource regularly like to take over some of the maintenance?

Need ability to mark slack server as insecure

There are a few different resources out there for interacting with slack, but I like the format of yours the best. Unfortunately I can't use it because it doesn't have an option to skip SSL verification, and my company only ever likes to sign things internally which causes SSL verification to fail. I will take a look if I can add a pull request for this myself, but honestly I'm not much of a web guy, so we'll see what I can do.

auto attach alerts all tasks

Is there anyway to add alerts to all the tasks in a pipeline?

Require image for ARM64 architecture

Hi team,

I am trying to use arbourd/concourse-slack-alert-resource on ARM64 architecture but it seems the arm64 tag is not available in Docker Hub.

I have successfully built the image using the command docker build -t <image_name> . on arm64 platform without any changes.

I have used buildx in Github actions to build and push the image for both platforms.

Commit Link - odidev@d28ff39

Github actions Link - https://github.com/odidev/concourse-slack-alert-resource/runs/1820414170?check_suite_focus=true

Dockerhub Link - https://hub.docker.com/repository/docker/odidev/concourse-slack-alert-resource

Please share your opinion on this. If interested, I will raise a PR.

Add retry logic for Slack http requests

Hi

We are getting this error quite frequently when sending notifications to slack:

wait for process completion: connection: decode failed: read tcp 127.0.0.1:49532->127.0.0.1:45955: read: connection reset by peer

I understand connection reset by peer occurs when when a peer (the other end) unexpectedly closes the underlying connection. But i'm simply wondering if there is a way to configure retries when this occurs. Thanks in advance.

Alert types `fixed` and `broke` fail for instanced pipelines with `error getting last build status: error requesting Concourse build status: unexpected status code: 404`

There is an issue with the new experimental Concourse Instanced Pipelines/Instance Groups, when the slack-alert resource tries to get the previous build status it fails with error getting last build status: error requesting Concourse build status: unexpected status code: 404

The instanced pipelines include instance vars as additional query parameters to the one and the same pipeline path e.g. https://ci.example.com/teams/development/pipelines/docker-images-build/jobs/build-something/builds/8?vars.instance=%22master%22&vars.team=%22common%22, apparently the instance parameters are not used when the slack-alert checks the previous build status.
There is a new $BUILD_PIPELINE_INSTANCE_VARS available for custom resources as metadata that should be used when querying for prev build status.

$BUILD_PIPELINE_INSTANCE_VARS
The instance vars of the instanced pipeline that the build's job lives in, serialized as JSON. See Grouping Pipelines for a definition of instanced pipelines.

can we use env vars in message and text ?

Broken OAuth in fixed/broke notifications for Concourse >= 6.0

It seems like Auth mechanism changed a bit for new versions and resource has an error when trying to authorize.

2020/05/27 08:56:32 error getting last build status: error connecting to Concourse: oauth2: cannot fetch token: 404 Not Found
Response: 404 page not found

Add support for Concourse 4.0.0

Auth flow has changed to remove basic auth. Now, teams can have local auth users. We need to detect what version of Concourse is being used, and if 4.0.0 and greater, pass different parameters.

One way to do this might be to use fly directly, like the official Concourse Pipeline resource does, but this resource really only makes one call to the ATC's API so perhaps its overkill. 🤔

Note: support for 4.0 is only for fixed or broke alert types.

Instance vars with an array panics the resource

The current implementation for instanced pipelines is limited to string=string key=values.

However, the documentation state that each value can be an arbitrary json data:

instance vars can hold arbitrary YAML/JSON data.

See: https://concourse-ci.org/instanced-pipelines.html

This includes arrays.

When using an array with this resource, it fails to unmarshall the $BUILD_PIPELINE_INSTANCE_VARS:

 panic: could not unmarshall $BUILD_PIPELINE_INSTANCE_VARS: {"days":["Monday","Tuesday","Wednesday","Thursday","Friday"],start_time":"08:00 PM","stop_time":"09:00 PM"}

  goroutine 1 [running]:
  github.com/arbourd/concourse-slack-alert-resource/concourse.NewBuildMetadata({0x0?, 0x0?})
  	/go/src/github.com/arbourd/concourse-slack-alert-resource/concourse/build.go:60 +0x874
  main.out(0xc000176000, {0x7ffef20f0dd1, 0xe})
  	/go/src/github.com/arbourd/concourse-slack-alert-resource/out/main.go:140 +0xa8
  main.main()

I have noticed that other implementation (such as https://github.com/mockersf/concourse-slack-notifier) do this differently and handle it well.
There is an ongoing PR mockersf/concourse-slack-notifier#86 about this topic.

Since both this project and mockersf/concourse-slack-notifier seemed to have lost interest from their maintainers, I have a forked, updated version with instance var support here:

makohoek/concourse-slack-notifier#5

Note that I would prefer to fix arbourd/concourse-slack-alert-resource but I have no Go experience at all.

Dependabot can't resolve your Go dependency files

Dependabot can't resolve your Go dependency files.

As a result, Dependabot couldn't update your dependencies.

The error Dependabot encountered was:

dmitri.shuralyov.com/gpu/[email protected]: unrecognized import path "dmitri.shuralyov.com/gpu/mtl" (https fetch: Get https://dmitri.shuralyov.com/gpu/mtl?go-get=1: EOF)

If you think the above is an error on Dependabot's side please don't hesitate to get in touch - we'll do whatever we can to fix it.

View the update logs.

No link to the build in the post in mattermost due to Footer not supported

I am not sure this is somehow related to the fact that i use mattermost, not slack, but when e.g. having a success message, the post does not include a link:

Any hints on how that could potentially happen - what special structure payload is used for link?

If templates #53 would be supported, i could do that with "message" myself.

Message param does not recognize concourse parameters

When using the message: parameter, the string does not replace the built in concourse parameters with the proper values.

ie:
- put: slack-alert
params:
alert_type: failed
message: "${BUILD_TEAM_NAME} Vault Smoke Tests Failed. Refer to the Runbooks at: none yet"

output in slack:
${BUILD_TEAM_NAME} Vault Smoke Tests Failed. Refer to the Runbooks at: none yet

This resource is compatible with mattermost

Just leaving it here for all the people googling for that - this ressource can properly post to a mattermost incoming hook.

No alert when job build errored

When the job errored (the orange color) there are no alerts to any channel.

I am wondering if I am using the fixed and broke alert types correctly as there is no example anywhere or am I missing something - may be using ensure?

I would appreciate some clarification if this is not a bug.

Here is my job definition:

  - name: build-app-image
    serial: true
    on_success:
      aggregate:
        - put: team-alert
          params:
            alert_type: success
        - put: general-alert
          params:
            alert_type: fixed
    on_failure:
      aggregate:
        - put: team-alert
          params:
            alert_type: failed
        - put: general-alert
          params:
            alert_type: broke
    on_abort:
      put: team-alert
      params:
        alert_type: aborted