fix: address PR review — curl timeouts, errexit in substitutions, statusless edge

- --max-time 30 on GitHub API and webhook curls
- shopt -s inherit_errexit so failures inside $(render/jq) assignments propagate
- all-statusless page keeps both placeholder lines instead of contradicting itself
- new flow scenarios: statuses-endpoint failure, statusless; superseded v1 plan doc untracked

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mikhail-dcl

.github/actions/slack-canvas-status/test/mock_api.py

@@ -2,12 +2,14 @@
 """Mock GitHub API + Slack workflow webhook for update-canvas.sh flow tests.
 
 Scenario is selected with the MOCK_SCENARIO env var:
-  normal       - dev's newest deployment succeeded; prd's newest failed, an older one succeeded.
-  degraded     - dev's newest deployment has no statuses yet, the next one failed, none
-                 succeeded; prd has no deployments.
-  empty        - no deployments in either environment.
-  gh_error     - the deployments endpoint returns HTTP 500.
-  webhook_fail - deployment data as in normal, but the webhook responds HTTP 500.
+  normal          - dev's newest deployment succeeded; prd's newest failed, an older one succeeded.
+  degraded        - dev's newest deployment has no statuses yet, the next one failed, none
+                    succeeded; prd has no deployments.
+  statusless      - dev's only deployment has no statuses; prd has no deployments.
+  empty           - no deployments in either environment.
+  gh_error        - the deployments endpoint returns HTTP 500.
+  gh_status_error - deployment data as in normal, but the statuses endpoint returns HTTP 500.
+  webhook_fail    - deployment data as in normal, but the webhook responds HTTP 500.
 Every request is appended to MOCK_LOG as one JSON line: {"path": ..., "body": ...},
 except GET /ping (a readiness probe) which is answered 200 and not logged.
 """
@@ -64,6 +66,11 @@
     "prd": [],
 }
 
+DEPLOYMENTS_STATUSLESS = {
+    "dev": [DEPLOYMENTS_DEGRADED["dev"][0]],
+    "prd": [],
+}
+
 STATUSES = {
     2: {"state": "success", "created_at": "2026-07-18T10:00:00Z"},
     12: {"state": "failure", "created_at": "2026-07-19T08:30:00Z"},
@@ -100,11 +107,16 @@ def do_GET(self):
                 self._respond([])
             elif SCENARIO == "degraded":
                 self._respond(DEPLOYMENTS_DEGRADED.get(environment, []))
+            elif SCENARIO == "statusless":
+                self._respond(DEPLOYMENTS_STATUSLESS.get(environment, []))
             else:
                 self._respond(DEPLOYMENTS.get(environment, []))
             return
         match = re.fullmatch(r"/repos/[^/]+/[^/]+/deployments/(\d+)/statuses", parsed.path)
         if match:
+            if SCENARIO == "gh_status_error":
+                self._respond({"message": "status boom"}, status=500)
+                return
             status = STATUSES.get(int(match.group(1)))
             self._respond([status] if status else [])
             return

.github/actions/slack-canvas-status/test/test-flow.sh

@@ -98,7 +98,25 @@ grep -q '"/webhook"' "$MOCK_LOG" || fail "expected webhook request to be recorde
 grep -q '500' "$ERR_FILE" || fail "expected HTTP 500 in stderr, got: $(cat "$ERR_FILE")"
 grep -q 'trigger_failed' "$ERR_FILE" || fail "expected webhook body in stderr, got: $(cat "$ERR_FILE")"
 
-# Scenario 5: degraded — dev's newest deployment has no statuses yet (skipped for
+# Scenario 5: the statuses endpoint errors -> loud non-zero exit with the body,
+# webhook never called (pins latest_status's explicit error handler).
+start_server gh_status_error
+if bash ../update-canvas.sh 2>"$ERR_FILE"; then
+  fail "expected non-zero exit when the statuses endpoint fails"
+fi
+stop_server
+grep -q 'status boom' "$ERR_FILE" || fail "expected statuses error body in stderr, got: $(cat "$ERR_FILE")"
+! grep -q '"/webhook"' "$MOCK_LOG" || fail "webhook must not be called when the statuses endpoint fails"
+
+# Scenario 6: every deployment is statusless -> both placeholders stay "—"
+# (no contradictory "no recent success" next to a last-deploy of "—").
+start_server statusless
+bash ../update-canvas.sh
+stop_server
+[[ "$(payload_field dev_running)" == "—" ]] || fail "statusless dev_running mismatch: $(payload_field dev_running)"
+[[ "$(payload_field dev_last_deploy)" == "—" ]] || fail "statusless dev_last_deploy mismatch: $(payload_field dev_last_deploy)"
+
+# Scenario 7: degraded — dev's newest deployment has no statuses yet (skipped for
 # the last-deploy line), the next one failed, none succeeded; prd is empty.
 start_server degraded
 bash ../update-canvas.sh

.github/actions/slack-canvas-status/update-canvas.sh

@@ -11,6 +11,9 @@
 # Optional env: GITHUB_API_BASE (defaults to https://api.github.com; tests
 #               point it at a mock).
 set -euo pipefail
+# Command substitutions must inherit errexit, or a failure inside
+# $(render_*)/$(jq …) assignments would be silently swallowed.
+shopt -s inherit_errexit
 
 GITHUB_API_BASE="${GITHUB_API_BASE:-https://api.github.com}"
 DEPLOY_TASK="dcl/container-deployment"
@@ -71,12 +74,15 @@ render_running_line() {
 }
 
 render_last_deploy_line() {
-  local state="$1" ref="$2" sha="$3" time="$4"
-  echo "$(state_emoji "$state") ${state} · $(short_ref "$ref") @ $(short_sha "$sha") · $(fmt_time "$time")"
+  local state="$1" ref="$2" sha="$3" time="$4" ts
+  # Assigned separately so a fmt_time failure propagates (with inherit_errexit)
+  # instead of being swallowed inside echo's argument list.
+  ts="$(fmt_time "$time")"
+  echo "$(state_emoji "$state") ${state} · $(short_ref "$ref") @ $(short_sha "$sha") · ${ts}"
 }
 
 gh_get() {
-  curl -sS --fail-with-body \
+  curl -sS --fail-with-body --max-time 30 \
     -H "Authorization: Bearer ${GITHUB_TOKEN}" \
     -H "Accept: application/vnd.github+json" \
     "${GITHUB_API_BASE}$1"
@@ -139,8 +145,12 @@ collect_env() {
   done
 
   # Deployments exist but none of the recent ones succeeded — say so instead of
-  # rendering the ambiguous "nothing deployed" placeholder.
-  RUNNING_LINE="⚠️ no recent success (last ${count} deploys)"
+  # rendering the ambiguous "nothing deployed" placeholder. Skipped when every
+  # deployment was statusless (no last-deploy line either): both placeholders
+  # stay "—" rather than contradicting each other.
+  if [[ "$LAST_LINE" != "$EMPTY_LINE" ]]; then
+    RUNNING_LINE="⚠️ no recent success (last ${count} deploys)"
+  fi
 }
 
 main() {
@@ -178,7 +188,7 @@ main() {
     }')"
 
   local response
-  response="$(printf '%s' "$payload" | curl -sS --fail-with-body \
+  response="$(printf '%s' "$payload" | curl -sS --fail-with-body --max-time 30 \
     -H "Content-Type: application/json; charset=utf-8" \
     --data-binary @- "$SLACK_WEBHOOK_URL")" || {
     echo "::error::Slack webhook rejected the payload: ${response}" >&2