Notify status-incident-triage when a public incident opens

.github/workflows/deploy.yml

@@ -757,6 +757,37 @@ jobs:
           printf '%s' "$CLOUDFLARE_API_TOKEN" | npx wrangler secret put \
             CLOUDFLARE_API_TOKEN --config packages/status/wrangler.jsonc
 
+      - name: 🔐 Sync status incident triage webhook secret
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          STATUS_INCIDENT_WEBHOOK_URL:
+            ${{ secrets.STATUS_INCIDENT_WEBHOOK_URL }}
+        run: |
+          set -euo pipefail
+          if [ -z "${STATUS_INCIDENT_WEBHOOK_URL:-}" ]; then
+            echo "STATUS_INCIDENT_WEBHOOK_URL unset; removing Worker secret if present."
+            set +e
+            delete_log="$(
+              CI=true npx wrangler secret delete STATUS_INCIDENT_WEBHOOK_URL \
+                --config packages/status/wrangler.jsonc 2>&1
+            )"
+            delete_status=$?
+            set -e
+            printf '%s\n' "$delete_log"
+            if [ "$delete_status" -eq 0 ]; then
+              exit 0
+            fi
+            if printf '%s' "$delete_log" | grep -qiE 'not found|does not exist|10056'; then
+              echo "Worker secret already absent; status incident ingest stays poll-only."
+              exit 0
+            fi
+            echo "Failed to delete STATUS_INCIDENT_WEBHOOK_URL." >&2
+            exit "$delete_status"
+          fi
+          printf '%s' "$STATUS_INCIDENT_WEBHOOK_URL" | npx wrangler secret put \
+            STATUS_INCIDENT_WEBHOOK_URL --config packages/status/wrangler.jsonc
+
       - name: 🩺 Healthcheck (status worker)
         shell: bash
         env:

docs/contributing/setup-manifest.md

@@ -318,6 +318,14 @@ through the Cloudflare Email REST API (from `ALERT_EMAIL_FROM` to
 `ALERT_EMAIL_TO`, both non-secret vars in `packages/status/wrangler.jsonc`).
 Without that secret, alert sends are skipped and logged.
 
+An optional Worker secret `STATUS_INCIDENT_WEBHOOK_URL` (synced from the
+same-named GitHub Actions secret when present) POSTs to a minted Kody webhook on
+incident open so `@kentcdodds/status-incident-triage` can enqueue a component
+fingerprint. The URL is a credential; do not commit it. When the GitHub secret
+is unset, deploy deletes the Worker secret if it exists so a stale URL cannot
+keep firing; the package still reconciles from the public `/status.json`
+snapshot.
+
 ## Optional Cloudflare offerings
 
 The default footprint stays intentionally small. If you want to add additional

packages/status/incident-webhook.node.test.ts

@@ -0,0 +1,61 @@
+import { expect, test } from 'vitest'
+import {
+	notifyStatusIncidentOpened,
+	type StatusIncidentOpenedPayload,
+} from './incident-webhook.ts'
+
+const payload: StatusIncidentOpenedPayload = {
+	event: 'incident.opened',
+	component: 'audit_db',
+	detail: 'timeout',
+	startedAt: 1_755_400_000_000,
+	statusUrl: 'https://status.kody.codes',
+}
+
+test('skips when the webhook URL is unset', async () => {
+	const result = await notifyStatusIncidentOpened({
+		webhookUrl: '  ',
+		payload,
+		fetchImpl: async () => {
+			throw new Error('fetch should not run')
+		},
+	})
+	expect(result).toEqual({ ok: true, skipped: 'unset' })
+})
+
+test('rejects non-https webhook URLs', async () => {
+	const result = await notifyStatusIncidentOpened({
+		webhookUrl: 'http://example.com/hook',
+		payload,
+		fetchImpl: async () => {
+			throw new Error('fetch should not run')
+		},
+	})
+	expect(result).toEqual({ ok: false, error: 'insecure-url' })
+})
+
+test('POSTs the incident payload and returns the status', async () => {
+	const calls: Array<{ url: string; init: RequestInit }> = []
+	const result = await notifyStatusIncidentOpened({
+		webhookUrl:
+			'https://kody.codes/@kentcdodds/webhooks/status-incident-triage/incident/secret',
+		payload,
+		fetchImpl: async (input, init) => {
+			calls.push({ url: String(input), init: init ?? {} })
+			return new Response(null, { status: 202 })
+		},
+	})
+	expect(result).toEqual({ ok: true, status: 202 })
+	expect(calls).toHaveLength(1)
+	expect(calls[0]?.init.method).toBe('POST')
+	expect(calls[0]?.init.body).toBe(JSON.stringify(payload))
+})
+
+test('maps non-OK HTTP responses without throwing', async () => {
+	const result = await notifyStatusIncidentOpened({
+		webhookUrl: 'https://kody.codes/hook',
+		payload,
+		fetchImpl: async () => new Response('nope', { status: 503 }),
+	})
+	expect(result).toEqual({ ok: false, error: 'http-503' })
+})

packages/status/incident-webhook.ts

@@ -0,0 +1,57 @@
+/**
+ * Optional outbound notify when the status worker opens an incident.
+ *
+ * The status worker stays dependency-free (ADR 0004): this is a plain HTTPS
+ * POST to a minted Kody webhook URL. Probe recording must not fail if the
+ * webhook is unset, slow, or down.
+ */
+
+export const statusIncidentWebhookTimeoutMs = 3000
+
+export type StatusIncidentOpenedPayload = {
+	event: 'incident.opened'
+	component: string
+	detail: string | null
+	startedAt: number
+	statusUrl: string
+}
+
+export type StatusIncidentWebhookResult =
+	| { ok: true; skipped: 'unset' }
+	| { ok: true; status: number }
+	| { ok: false; error: string }
+
+export async function notifyStatusIncidentOpened(input: {
+	webhookUrl: string | null | undefined
+	payload: StatusIncidentOpenedPayload
+	fetchImpl?: typeof fetch
+}): Promise<StatusIncidentWebhookResult> {
+	const webhookUrl = input.webhookUrl?.trim()
+	if (!webhookUrl) return { ok: true, skipped: 'unset' }
+
+	let url: URL
+	try {
+		url = new URL(webhookUrl)
+	} catch {
+		return { ok: false, error: 'invalid-url' }
+	}
+	if (url.protocol !== 'https:') return { ok: false, error: 'insecure-url' }
+
+	try {
+		const response = await (input.fetchImpl ?? fetch)(url, {
+			method: 'POST',
+			headers: { 'content-type': 'application/json' },
+			body: JSON.stringify(input.payload),
+			signal: AbortSignal.timeout(statusIncidentWebhookTimeoutMs),
+		})
+		if (!response.ok) {
+			return { ok: false, error: `http-${response.status}` }
+		}
+		return { ok: true, status: response.status }
+	} catch (error) {
+		return {
+			ok: false,
+			error: error instanceof Error ? error.message : String(error),
+		}
+	}
+}

packages/status/readme.md

@@ -31,6 +31,14 @@ returns Cloudflare 1016. Component probes never use the status hostname, so a
   (`STATUS_ALERT_DAILY_LIMIT`). Alert links use `STATUS_PAGE_URL`
   (`https://status.kody.codes`).
 
+When an incident opens, the worker also POSTs a small JSON payload to
+`STATUS_INCIDENT_WEBHOOK_URL` when that Worker secret is set (a minted Kody
+webhook for `@kentcdodds/status-incident-triage`). The notify is fire-and-forget
+with a short timeout so a down or missing webhook cannot stall probes or email.
+Until the secret exists, the triage package still enqueues from
+`GET /status.json` on its 15m sweep. Unsetting the GitHub secret on a later
+deploy deletes the Worker secret so a stale URL cannot keep firing.
+
 ## Provider incidents (Cloudflare)
 
 Each cron tick also fetches Cloudflare's public Statuspage feed

packages/status/status-store.ts

@@ -11,6 +11,7 @@ import {
 	initialComponentProbeState,
 	type ComponentProbeState,
 } from './incidents.ts'
+import { notifyStatusIncidentOpened } from './incident-webhook.ts'
 import { jobsProbeOrigin, runAllProbes } from './probes.ts'
 import {
 	fetchRelevantProviderIncidents,
@@ -51,6 +52,11 @@ export type StatusWorkerEnv = {
 	CLOUDFLARE_API_BASE_URL?: string
 	/** Worker secret: Cloudflare API token with Email Sending permission. */
 	CLOUDFLARE_API_TOKEN?: string
+	/**
+	 * Optional minted Kody webhook URL for status-incident-triage ingest.
+	 * Treat as a credential. When unset, sweep polling is the only ingest path.
+	 */
+	STATUS_INCIDENT_WEBHOOK_URL?: string
 }
 
 const sampleRetentionMs = 25 * 60 * 60 * 1000
@@ -225,6 +231,28 @@ export class StatusStore extends DurableObject<StatusWorkerEnv> {
 					detail: outcome.detail,
 				}),
 			)
+			this.ctx.waitUntil(
+				notifyStatusIncidentOpened({
+					webhookUrl: this.env.STATUS_INCIDENT_WEBHOOK_URL,
+					payload: {
+						event: 'incident.opened',
+						component: outcome.component,
+						detail: outcome.detail,
+						startedAt: now,
+						statusUrl: this.env.STATUS_PAGE_URL,
+					},
+				}).then((result) => {
+					if (!result.ok) {
+						console.warn(
+							'status-incident-webhook-failed',
+							JSON.stringify({
+								component: outcome.component,
+								error: result.error,
+							}),
+						)
+					}
+				}),
+			)
 		}
 		if (transition === 'resolved') {
 			this.ctx.storage.sql.exec(