[omattsson]

Summary

Commands for the outbound webhook channels (/api/v1/admin/notification-channels, devops or admin). Each command takes a channel name or ID.

• notification channel list and get (get also lists the subscribed events).
• notification channel create --name --url|--url-env [--format generic|teams] [--secret-env NAME|--secret-stdin] [--disabled] [--filter-name glob] [--filter-owner id] [--filter-definition name|id] [--filter-cluster id] [--event type].
• notification channel update <channel>: only the given flags change. Also --enable, --disable, --clear-secret and --clear-filters.
• notification channel delete <channel> [--yes].
• notification channel events, subscriptions <channel>, subscribe <channel> --event ... | --none.
• notification channel test <channel>: exit code 1 when the webhook does not accept the test event.
• notification channel logs <channel> [--limit] [--offset].

Security

• The webhook URL can hold a token (for example the signature of a Teams workflow URL). Every output mode shows only scheme://host[:port]/..., also -o json and -o yaml, unless --show-url is set. This is a deliberate exception to "JSON prints the full API response".
• --url-env NAME reads the URL from an environment variable, so it stays out of the shell history and the process list. Error texts never contain the URL. A URL that does not parse is refused before the request.
• The API takes the HMAC secret value (secret). The CLI reads it only from --secret-env NAME or --secret-stdin (hidden input on a terminal), never from a flag value. The server never returns it. --debug logs no request bodies.

Other behaviour

• A --filter-* flag on update replaces all filters. --clear-filters sends {}. subscribe replaces all event types. --none sends [].
• create --event checks the event types against event-types before the channel is created. If the subscription still fails, the command prints the channel (the ID with -q) and an error with the subscribe command.
• Server warnings of create and update (filter IDs that do not exist) go to stderr.

Contract tests

test/contract/response_contract_test.go now checks 15 more types against the server schema: UIConfig, FollowState, DeployPreview, ChartDeployPreview, ActionList, ActionJobLog, UpgradeCheck, UpgradeChanges, TemplateLinkRequest, the channel create and update requests, NotificationChannelFilters and NotificationChannel.

Tests

• go test ./... passes, also go test -shuffle=on ./cmd. staticcheck (latest) has no findings.
• New tests: cli/cmd/notification_channel_test.go (masking in every mode, secret sources, usage errors, partial updates, the subscription-failure path, test and logs) and cli/pkg/client/notification_channels_test.go.

Closes #159

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: omattsson/stackctl/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 33445d44-cec4-47f9-9a6a-f256595fb059

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}