fix(notifications): mark slice flags as changed after docker secret expansion

[nicholas-fedor]

This PR fixes a regression where notification URLs configured via Docker Secrets were passed to Shoutrrr as file paths instead of their contents.

Problem

When WATCHTOWER_NOTIFICATION_URL points to a Docker Secret file, such as /var/secrets/WATCHTOWER_NOTIFICATION_URL, Watchtower reads the file successfully but then creates the Shoutrrr sender with the file path instead of the URL inside it. This results in the notifications process failing to initialize with the following error: Failed to initialize Shoutrrr notifications" error="creating sender with options for URLs [/run/secrets/WATCHTOWER_NOTIFICATION_URL]: error initializing router services: unknown service: \"\"

Solution

Set flag.Changed = true immediately after a successful sliceValue.Replace in getSecretFromFile. This signals that the flag value is authoritative, so stringSliceValue reads the expanded pflag value instead of falling back to os.Getenv.

Changes

• Set flag.Changed = true in getSecretFromFile after slice replacement
• Add regression tests at the flag expansion, config-load, and notifier layers

Summary by CodeRabbit

• Bug Fixes
  • Fixed secret values loaded from files being treated as file paths instead of their contents.
  • Ensured secret-backed notification settings resolve correctly, including email, Slack, Microsoft Teams, Gotify, and notification URLs.
  • Preserved expanded secret values when environment configuration is reapplied.
  • Improved handling of slice-based secret settings and porcelain-mode values.
  • Ensured invalid notification URLs fail clearly while valid Gotify URLs are accepted.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a9d58480-411b-44b3-ab17-e8b67a722e34

📥 Commits

Reviewing files that changed from the base of the PR and between 7bb439c and 2a759ea.

📒 Files selected for processing (5)

• internal/config/precedence_test.go
• internal/config/viper_get_test.go
• internal/flags/flags.go
• internal/flags/flags_test.go
• pkg/notifications/shoutrrr_test.go

---

📝 Walkthrough

Walkthrough

Secret-file expansion now marks processed flags as changed, preserves expanded values against environment re-application, and resolves notification secrets during configuration loading. Tests cover precedence, multiline and porcelain inputs, legacy notification secrets, and notifier creation.

Changes

Secret File Expansion and Notification Resolution

Layer / File(s)	Summary
Flag expansion state and ordering internal/flags/flags.go, internal/flags/flags_test.go	Secret expansion marks string and slice flags as changed, supports multiline and porcelain values, and prevents subsequent environment bridging from replacing expanded contents.
Configuration precedence and secret loading internal/config/precedence_test.go, internal/config/viper_get_test.go	Configuration loading resolves notification URL and legacy notification secrets from file contents, while tests verify flag, environment, and Viper precedence.
Notifier input validation pkg/notifications/shoutrrr_test.go	Notifier tests cover fatal handling for invalid file-path input and successful Gotify URL creation.

Possibly related PRs

• nicholas-fedor/watchtower#1069: Also changes notification URL secret-file expansion and splitting in internal/flags/flags.go.
• nicholas-fedor/watchtower#1971: Also modifies notification URL secret-file handling and validation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: marking slice flags changed after Docker secret expansion.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 8 complexity · 28 duplication

Metric	Results
Complexity	8
Duplication	28

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@            Coverage Diff             @@
##             main    #2060      +/-   ##
==========================================
- Coverage   72.25%   72.24%   -0.02%     
==========================================
  Files         120      120              
  Lines       13318    13333      +15     
==========================================
+ Hits         9623     9632       +9     
- Misses       3271     3279       +8     
+ Partials      424      422       -2     

Files with missing lines	Coverage Δ
internal/flags/flags.go	70.68% <100.00%> (+0.09%)	⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.