feat(api): emit SSE events for the HTTP API check endpoint by nicholas-fedor · Pull Request #2066 · nicholas-fedor/watchtower

nicholas-fedor · 2026-07-29T19:00:02Z

This PR adds SSE event emission for POST /v1/check, so SSE subscribers are notified when a check-only run completes.

Problem

The /v1/events SSE endpoint only emits events for updates. A registry check triggered via POST /v1/check produces no SSE event and leaves API consumers with limited options for determining when the check is completed.

Solution

Added scan_started, scan_completed, and scan_failed event types for check runs.
The construction of the redacted configuration information that is provided by the scan_started event was also refactored to centralize the mapping and reduce repetition for future additions of SSE events.

Changes

Add scan_started, scan_completed, and scan_failed SSE events to the POST /v1/check handler.
Extract ScanStartedData construction into a shared helper used by both the update and check routes.
Update the check handler constructor to accept an optional broadcaster and pre-built scan-started payload.
Add handler tests verifying event emission on success, on check failure, and when no broadcaster is configured.
Update route-registration tests to provide an EventBroadcaster.

Summary by CodeRabbit

New Features
- Added SSE scan lifecycle notifications for check runs on /v1/check: scan_started, scan_completed, and scan_failed.
Bug Fixes
- scan_started payload is now constructed from redacted update parameters.
- On check errors, scan_failed now returns the fixed message: "failed to check for updates".
Documentation
- Updated HTTP API docs with new SSE Events sections for the check and update endpoints, clarifying outcomes and counters.
Tests
- Expanded SSE emission tests for success, failure, and when notifications are disabled.

- Publish scan_started, scan_completed, and scan_failed events during check runs - Add event broadcaster and pre-built scan data to check handler - Introduce NewScanStartedData helper for redacted policy flags - Update route registration and handler tests to use the event broadcaster

coderabbitai · 2026-07-29T19:00:22Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b08d13c1-f21e-474d-81b5-d0ae93d84fc3

📥 Commits

Reviewing files that changed from the base of the PR and between 400319b and f06880b.

📒 Files selected for processing (2)

internal/api/handlers/check/handler.go
internal/api/handlers/check/handler_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

internal/api/handlers/check/handler_test.go
internal/api/handlers/check/handler.go

📝 Walkthrough

Walkthrough

The check API now emits scan_started, scan_failed, and scan_completed SSE events. Scan-start payload construction is centralized, route wiring passes event dependencies into the handler, and endpoint documentation describes the event behavior.

Changes

Check scan event flow

Layer / File(s)	Summary
Scan-start payload construction `internal/api/handlers/events/events.go`, `internal/actions/actions.go`	Adds centralized construction of redacted scan-start payloads and uses it for update notifications.
Handler lifecycle emission `internal/api/handlers/check/handler.go`, `internal/api/handlers/check/handler_test.go`	The handler optionally emits started, failed, and completed events; tests verify sequences, errors, counts, and disabled broadcasting.
Route dependency wiring `internal/api/routes/check.go`, `internal/api/routes/check_test.go`	The route precomputes scan-start data and passes it with the event broadcaster to the check handler.
SSE endpoint documentation `docs/http-api/endpoints/check/index.md`, `docs/http-api/endpoints/events/index.md`, `docs/http-api/endpoints/update/index.md`	Documents scan lifecycle events, broadcast conditions, completion counts, and update notifications.
Existing flag test formatting `internal/flags/flags_test.go`	Reformats a notification URL test without changing its assertions or behavior.

Sequence Diagram(s)

sequenceDiagram
  participant CheckAPIClient
  participant CheckHandler
  participant EventBroadcaster
  participant CheckFunc
  CheckAPIClient->>CheckHandler: submit check request
  CheckHandler->>EventBroadcaster: publish scan_started
  CheckHandler->>CheckFunc: execute check
  alt check fails
    CheckFunc-->>CheckHandler: return error
    CheckHandler->>EventBroadcaster: publish scan_failed
    CheckHandler-->>CheckAPIClient: return HTTP 500
  else check succeeds
    CheckFunc-->>CheckHandler: return container results
    CheckHandler->>EventBroadcaster: publish scan_completed with counts
    CheckHandler-->>CheckAPIClient: return success
  end

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding SSE event emission to the HTTP API check endpoint.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codacy-production · 2026-07-29T19:01:18Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 26 duplication

Metric Results

Complexity 0

Duplication 26

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

codecov · 2026-07-29T19:01:49Z

Codecov Report

❌ Patch coverage is 68.75000% with 15 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/api/handlers/events/events.go	0.00%	14 Missing ⚠️
internal/actions/actions.go	0.00%	1 Missing ⚠️

@@            Coverage Diff             @@
##             main    #2066      +/-   ##
==========================================
+ Coverage   72.25%   72.32%   +0.06%     
==========================================
  Files         120      120              
  Lines       13333    13365      +32     
==========================================
+ Hits         9634     9666      +32     
  Misses       3277     3277              
  Partials      422      422

Files with missing lines	Coverage Δ
internal/api/handlers/check/handler.go	`66.01% <100.00%> (+13.96%)`	⬆️
internal/api/routes/check.go	`63.33% <100.00%> (+4.71%)`	⬆️
internal/actions/actions.go	`65.39% <0.00%> (+1.57%)`	⬆️
internal/api/handlers/events/events.go	`76.19% <0.00%> (-21.77%)`	⬇️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/api/handlers/check/handler.go`:
- Around line 151-159: Update the scan failure event construction in the check
handler’s eventBroadcaster.Publish path to avoid sending err.Error() through
ScanFailedData. Publish the same generic client-safe failure message used by the
HTTP response, or an intentionally mapped safe description, while retaining the
full err details in the existing server log.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7cb1da4a-b66f-4d25-984b-9032602ada9e

📥 Commits

Reviewing files that changed from the base of the PR and between 64495be and 6f6ff20.

📒 Files selected for processing (7)

internal/actions/actions.go
internal/api/handlers/check/handler.go
internal/api/handlers/check/handler_test.go
internal/api/handlers/events/events.go
internal/api/routes/check.go
internal/api/routes/check_test.go
internal/flags/flags_test.go

- Add SSE Events section to check endpoint documentation - Add SSE Events section to update endpoint documentation - Document scan and update event broadcasting conditions in events endpoint

- Replace raw error string with generic message to prevent information leakage - Update test assertion to match sanitized error message

nicholas-fedor linked an issue Jul 29, 2026 that may be closed by this pull request

[Feature request] Emit SSE events for check-only runs (POST /v1/check) #2062

Closed

2 tasks

coderabbitai Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread internal/api/handlers/check/handler.go Outdated

nicholas-fedor added 2 commits July 29, 2026 12:19

docs(http-api): document SSE events across API endpoints

400319b

- Add SSE Events section to check endpoint documentation - Add SSE Events section to update endpoint documentation - Document scan and update event broadcasting conditions in events endpoint

fix(http-api): sanitize error details in scan_failed SSE event

f06880b

- Replace raw error string with generic message to prevent information leakage - Update test assertion to match sanitized error message

nicholas-fedor merged commit 9be168f into main Jul 29, 2026
20 checks passed

nicholas-fedor deleted the feat/2062-emit-sse-events-for-http-api-check branch July 29, 2026 19:25

coderabbitai Bot mentioned this pull request Jul 31, 2026

fix(ephemeral): prevent repeated self-updates when host ports are published #2079

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(api): emit SSE events for the HTTP API check endpoint - #2066

feat(api): emit SSE events for the HTTP API check endpoint#2066
nicholas-fedor merged 3 commits into
mainfrom
feat/2062-emit-sse-events-for-http-api-check

nicholas-fedor commented Jul 29, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

codacy-production Bot commented Jul 29, 2026

Uh oh!

codecov Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

nicholas-fedor commented Jul 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Changes

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

codacy-production Bot commented Jul 29, 2026

Up to standards ✅

Uh oh!

codecov Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

nicholas-fedor commented Jul 29, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading

codecov Bot commented Jul 29, 2026 •

edited

Loading