ci: alert on Slack when a release publish job fails - #1244

Resolves https://github.com/airbytehq/airbyte-internal-issues/issues/18062:

• https://github.com/airbytehq/airbyte-internal-issues/issues/18062

Close on merge: yes — internally filed, no customer to confirm with.

Summary

Adds a final notify-publish-failure job to the CDK Publish workflow (.github/workflows/publish.yml) that posts to Slack when a tag-triggered release fails to publish. Today the only Slack messages come from update-connector-builder, which doesn't depend on publish_sdm/publish_cdk (so their failures are invisible and it still posts success) and is skipped when publish_manifest_server fails (so its failure message never posts). Example: run 17474487668 had all three publish jobs fail, the Builder job skipped, and no alert; run 32521540962 had build fail with nothing posted.

notify-publish-failure:
  needs: [build, publish_cdk, publish_sdm, publish_manifest_server]
  if: failure() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
  steps:
    - Summarize job results   # needs.<job>.result -> FAILED_JOBS / NOT_RUN_JOBS (via env:, not inline ${{ }})
    - Post to Slack           # same pattern as the Builder job: slackapi/slack-github-action@v1.23.0,
                              # SLACK_BOT_TOKEN_AIRBYTE_TEAM, channel C04J1M66D8B, continue-on-error: true

The message includes the version (needs.build.outputs.VERSION, falling back to github.ref_name when build itself failed), the failed job(s), jobs that didn't run (skipped/cancelled because of an upstream failure), and a link to the run. Existing job dependencies are unchanged and there are no Docker Hub retries (both out of scope per the issue).

Secret scope: the new job has no environment:. SLACK_BOT_TOKEN_AIRBYTE_TEAM is already used by notify-slack in slack-pr-notification.yml, which also has no environment:, so it looks like a repo- or org-level secret. I couldn't list the repo's secrets to confirm this (HTTP 403).

Case analysis

failure() in a job-level if: is true when any ancestor job failed. It is false on full success and on cancellation. Without it, a job whose needs failed is skipped.

The alert step has continue-on-error: true, and the summary step only classifies strings, so the alert can't fail the workflow. A failure in the alert job would still show on its own job, but it can't turn a successful release red, because the job only runs after something has already failed.

Validation

• actionlint .github/workflows/publish.yml: no new findings. The output is identical in size (36 lines) to main, and the findings are pre-existing shellcheck infos in the build and Builder jobs.
• I pulled the summary step's script out of the YAML and ran it locally with the needs.*.result combinations above. Example output for a build failure: FAILED_JOBS=Build Python Package and NOT_RUN_JOBS=Publish CDK to PyPI, Publish SDM to DockerHub, Publish Manifest Server to DockerHub.
• Not tested end to end: that would need a real tag release, and I did not push any tags.

Open decisions for the reviewer

• Channel: defaults to #dev-connectors-extensibility-releases (C04J1M66D8B), where the existing release messages go. Should it go to an APIs team channel instead?
• Prereleases: alerts are limited to tag-triggered releases. workflow_dispatch prereleases are excluded because whoever starts one is watching it.
• Builder job failure: update-connector-builder is not in needs; it already posts its own failure message.

Declarative-First Evaluation

N/A: this is a CI workflow change only, with no connector or declarative components.

Test Coverage

This repo has no automated test harness for GitHub Actions workflows. Coverage is actionlint plus running the summary step's script locally for each scenario (see Validation).

Link to Devin session: https://app.devin.ai/sessions/1915791f4159447dadacbafc3d35346d
Open in Devin Desktop: https://app.devin.ai/desktop/session/1915791f4159447dadacbafc3d35346d?variant=devin