Story-777 functions lane walkthrough publishing

Slack notification on walkthrough publish

Publishing a walkthrough should leave a visible trail for the team. This Story adds one Slack message per publish run, without making Slack availability part of the publishing critical path.

The mental model: S3 and CloudFront publish the artifact. Slack is a receipt. The workflow reads the webhook just in time, posts the receipt, and keeps the artifact published even if Slack is down.

What changed

Permission

The publisher role can read only the pramaan-walkthroughs-slack-webhook secret.

Batching

The workflow turns every line in /tmp/published-walkthroughs.jsonl into one section in a single Slack payload.

Message shape

The Slack blocks show Story, repo, each walkthrough title, each public URL, the PR, and the author.

Failure mode

The step logs a warning and continues when the secret is missing, malformed, or Slack rejects the post.

Why Secrets Manager

A webhook URL is effectively a bearer token. Keeping it in GitHub Actions secrets would work, but it would spread Slack delivery ownership into the repo settings. Secrets Manager keeps the operational secret in AWS, next to the role that is allowed to read it.

The important engineering boundary is the IAM resource ARN. The workflow does not get broad secret read access. It gets one action on one secret family in ap-south-1.

How the message is built

The upload step already writes compact metadata for each published walkthrough. This Story reuses that file instead of re-parsing filenames later. That makes the Slack step a renderer: read metadata, build Block Kit JSON, post it.

For a push that publishes multiple walkthroughs, the message still arrives once. Each walkthrough gets its own title and link section, so Slack stays useful without flooding the channel.

How to verify

  1. Merge this PR after the webhook has been rotated in Slack and stored in Secrets Manager.
  2. Manually dispatch publish-walkthroughs.yml or merge a walkthrough HTML change.
  3. Confirm the run uploads the walkthrough and rebuilds index.html.
  4. Confirm #walkthroughs receives one message with this title and a 777.html link.
  5. Click the link and confirm CloudFront serves the walkthrough.

Product outcome: every published walkthrough now announces itself where the team already coordinates the work, while the publishing path remains resilient if notification delivery flakes.