Notify devs via Slack when their change hits the latest track

[sfreudenthaler]

Summary

• New reusable workflow cicd_comp_notify-latest-promotion.yml, wired into cicd_6-release.yml right after promote-latest succeeds.
• Diffs the release against the previous one via the GitHub compare + commits/pulls API to find PR authors (no commit-message parsing).
• Resolves GitHub logins to Slack via the existing utility_slack-channel-resolver.yml (same pattern as pr-notifier).
• Looks up which environments are currently on the latest evergreen track via the dotUsage GET /environments API, with a generic fallback if that call fails.
• Computes the next weekday 10:00 AM America/New_York rollout window and includes it in the message.
• Gated on the existing notify_slack == 'true' toggle and the same CLI/LTS/non-v exclusion the Slack report step already uses.

Known limitations (by design, ponytail)

• The dotUsage lookup runs on the repo's only self-hosted runner ([self-hosted, linux, x64, ubuntu-server]), since usage.dotcms.cloud sits behind a corporate-IP WAF allowlist that GitHub-hosted runners aren't on. Not yet verified that this runner's egress IP is on that allowlist — if it isn't, the lookup step fails soft and the message falls back to generic wording ("the latest-track environments") rather than naming customers.
• DOTUSAGE_TOKEN is a personal viewer-role token (expires ~Jan 27); fine for now per the requester, but worth swapping for a dedicated service token later.
• Previous-release lookup assumes a release's diff is under 250 commits (GitHub compare API single-page cap) — a non-issue for a single release's worth of commits.

Closes: #36859

[claude]

Claude finished @sfreudenthaler's task in 2m 35s —— View job

---

Code Review

Reviewed the two changed files plus the utility_slack-channel-resolver.yml contract these depend on.

New Issues

• 🟠 High: .github/workflows/cicd_comp_notify-latest-promotion.yml:75 — collect-authors emits a comma-delimited login list (paste -sd, -), but utility_slack-channel-resolver.yml expects a space-delimited list. The resolver word-splits with github_users_array=(${github_users}) (line 70, unquoted → splits on whitespace only) and documents its input as a "Github users space delimited list". So alice,bob,carol is treated as a single token alice,bob,carol: it matches no slack-mappings.json entry, the email fallback hits api.github.com/users/alice,bob,carol (404), no channel resolves, and the resolver falls through to default_channel_id (C028Z3R2D, eng). Net effect: no author is ever notified individually — every run posts one generic message to #eng, silently, which defeats the PR's stated purpose. Compare the working caller cicd_scheduled_notify-seated-prs.yml:139, which uses members.join(' '). Fix: emit space-delimited logins (e.g. paste -sd' ' -, or tr '\n' ' '). Fix this →

Notes (non-blocking)

• 🟡 Medium: cicd_comp_notify-latest-promotion.yml:126 — the dotUsage parse assumes .data[] with .track, .tenant, .environment fields. The curl -sf ... || true guards a failed request (empty BODY → generic fallback), but a successful response whose JSON shape differs (no .data, or .track absent) makes jq emit an empty string, which the [ -z "$ENVS" ] branch then reports as "no environments (none currently subscribed)" — a misleading affirmative rather than a fallback. Assumption: the API returns {data:[{track,tenant,environment}...]}. What to verify: the actual GET /environments response schema; consider distinguishing "jq found zero latest-track envs" from "jq couldn't parse the shape". The PR body already flags the WAF/egress uncertainty, so this is the residual schema risk.

• 🟡 Medium: cicd_comp_notify-latest-promotion.yml:158 — no replay guard. A re-run of the release workflow (retry, or a second GA the same day) re-diffs against the previous release and re-notifies the same authors. Given the message is informational and the PR notes this is "by design (ponytail)," this is a note, not a blocker — worth a one-line acknowledgement in the workflow header comment so it isn't mistaken for a bug later.

Everything else looks sound: the caller gating in cicd_6-release.yml:319-335 correctly waits on release (so the GitHub Release exists before the previous-tag diff), reuses the established notify_slack + CLI/LTS/non-v exclusion, the matrix uses fail-fast: false + continue-on-error: true so one bad channel can't fail the release, and secrets are passed rather than interpolated into shell. The comma/space mismatch is the one thing that stops the feature from working as intended.