Notify sneak's ntfy topic on every CI deploy (closes #48) (#49)

.gitea/workflows/deploy.yml

@@ -112,20 +112,24 @@ jobs:
     notify:
         runs-on: ubuntu-latest
         needs: [build, deploy]
-        # Run whether the build and deploy passed or failed, and never turn a
-        # deploy that worked into a failed check: a notification that cannot be
-        # sent must leave the deploy's result exactly as it was.
+        # Run whether the build and deploy passed or failed. The Notify step
+        # carries continue-on-error: true so a notification that cannot be sent
+        # leaves the deploy's result exactly as it was.
         if: always()
-        continue-on-error: true
         container:
             # node 20.20.2-bookworm, 2026-08-09. Same pinned image as the deploy
             # job, chosen because it ships curl; no extra packages to install.
             image: node@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5
         steps:
             # needs.deploy.result is "success" only when the deploy job actually
-            # published; anything else -- a failed build, a failed deploy, a
-            # cancelled run -- is reported as a failure with a link to the run.
+            # published; anything else -- a failed build or a failed deploy -- is
+            # reported as a failure with a link to the run.
             - name: Notify
+              # curl failing (ntfy unreachable or erroring, or NTFY_TOPIC
+              # absent) must not fail the run, so continue-on-error lives on
+              # this step and not on the job: on this Gitea a job-level flag
+              # still marks the job failed and reddens the commit.
+              continue-on-error: true
               env:
                   RESULT: ${{ needs.deploy.result }}
                   NTFY_TOPIC: ${{ secrets.NTFY_TOPIC }}
@@ -133,13 +137,13 @@ jobs:
                   short="$(printf '%.7s' "$GITHUB_SHA")"
                   run_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
                   if [ "$RESULT" = success ]; then
-                      curl -fsS \
+                      curl -fsS --max-time 10 \
                           -H "Title: lora.vegas deployed from $GITHUB_REF_NAME" \
                           -d "$short deployed to https://lora.vegas/" \
                           "https://ntfy.sh/$NTFY_TOPIC"
                   else
-                      curl -fsS \
-                          -H "Title: lora.vegas deploy failed" \
+                      curl -fsS --max-time 10 \
+                          -H "Title: lora.vegas deploy from $GITHUB_REF_NAME failed" \
                           -H "Priority: high" \
                           -d "Run: $run_url" \
                           "https://ntfy.sh/$NTFY_TOPIC"

TODO.md

@@ -34,6 +34,16 @@ leaning on `.gitignore` (https://git.eeqj.de/sneak/lora.vegas/issues/33).
 
 # Completed Steps
 
+- 2026-11-05: added a `notify` job to the deploy workflow that posts an ntfy
+  message on every deploy, success or failure (closes
+  https://git.eeqj.de/sneak/lora.vegas/issues/48). The job runs `if: always()`
+  so it fires whether the build and deploy passed or failed, and the Notify step
+  carries `continue-on-error: true` so a notification that cannot be sent leaves
+  the deploy's result exactly as it was. On success the message body is the
+  short commit plus the site URL, and on failure it is a link to the run. The
+  topic comes from the `NTFY_TOPIC` Actions secret, which sneak must add before
+  anything is sent; the topic is never written in the repository. Both curl
+  calls carry `--max-time 10` so a stalled ntfy cannot hold the run open
 - 2026-10-21: made `script/lint` fail when two pages write the same output path
   (https://git.eeqj.de/sneak/lora.vegas/issues/25). `Dockerfile.lint` now runs
   `hugo --minify --printPathWarnings --panicOnWarning`. `--printPathWarnings`