feat(slack): slack-notify-on always|failure switch

[juliojimenez]

Summary

Adds the slack-notify-on input promised in the follow-ups of #132. With failure, a successful run posts nothing and logs one line, Slack notification skipped; failures post as before. The default is always, so nothing changes for consumers that already set slack-webhook-url.

Configuration failures bypass the switch on purpose. A job that cannot start is a failure, and an invalid SLACK_NOTIFY_ON value is itself one, so notifyConfigFailure still posts when the webhook is valid.

New input

Input	Purpose
slack-notify-on	always (default) posts every run; failure posts failed runs only. Case-insensitive, trimmed, ignored without a webhook.

Any other value is rejected at start-up with invalid SLACK_NOTIFY_ON: "..." (must be always or failure). The value is not sensitive, so the error may quote it.

Changes

• internal/config: SlackNotifyAlways / SlackNotifyOnFailure constants, SlackNotifyOn field, closed-set check in Sanitize. An empty field means always, so a Config built without LoadConfig still posts.
• cmd/clickbom: reportOutcome sits in front of notifyOutcome and applies the switch via shouldNotify; the skip is logged at Info only when a webhook is configured.
• action.yml: the input and SLACK_NOTIFY_ON env entry.
• README.md: table row, explanatory bullet, usage snippet; the version note now says slack-notify-on first ships in v2.2.0.
• CLAUDE.md: execution-flow notes for the switch and the deliberate bypass on configuration failures.
• Dockerfile: version labels set to 2.2.0 for the upcoming release.

Security properties

• The input is non-sensitive and deliberately kept out of sensitiveEnvVars and Secrets. TestConfigSecrets now asserts that failure is never a redaction needle: it would blank the word "failure" in every posted error.
• No new data reaches the Slack message. The switch only decides whether the existing payload is sent.

Testing

• go test -race ./..., golangci-lint run, gofmt and gocyclo pass.
• TestLoadConfig_SlackNotifyOn: default, both values with case and whitespace variants, rejected values naming the variable and the value, and the empty-field path through Sanitize.
• TestShouldNotify and TestReportOutcome_HonoursNotifyOn: the four mode × outcome combinations against a local webhook server, the Info skip log, and silence when no webhook is configured.
• Not exercised: a post to a live Slack workspace.

Follow-ups

• Tag v2.2.0 and bump the ClickHouse/sbom workflows.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 91.66667% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/clickbom/main.go	85.71%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Copilot review overview

🟢 Approval recommended

The behavior is consistent across configuration, execution, metadata, documentation, and focused tests.

Review effort: Balanced
Findings: None

What changed in this PR

Adds configurable Slack notification filtering while preserving failure alerts and existing defaults.

Changes:

• Adds and validates the always/failure notification mode.
• Suppresses successful notifications in failure-only mode with test coverage.
• Documents the input and updates release metadata.

File	Description
README.md	Documents notification modes and usage.
internal/​config/​config.go	Loads, normalizes, and validates the mode.
internal/​config/​config_test.go	Tests configuration and sensitivity behavior.
cmd/​clickbom/​main.go	Applies notification filtering.
cmd/​clickbom/​main_test.go	Tests filtering, posting, and logging.
action.yml	Exposes the new action input.
CLAUDE.md	Updates execution-flow documentation.
Dockerfile	Updates version labels to 2.2.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.