From df80a666a756db006dae36e12989fcafbf8db1af Mon Sep 17 00:00:00 2001 From: Mike Macpherson Date: Mon, 20 Jul 2026 10:52:11 -0700 Subject: [PATCH 1/3] ci: don't fail icon updates when GEMINI_API_KEY is missing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The updater failed silently-in-a-corner every week since 2026-06-14 because the repo secret vanished — icon updates were hostage to the search-data step. Skip description generation (with a loud log line) when the key is absent; new icons just lag in semantic search until the key returns. Co-Authored-By: Claude Fable 5 --- .github/workflows/update-lucide.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-lucide.yml b/.github/workflows/update-lucide.yml index 216c0a6..659e33d 100644 --- a/.github/workflows/update-lucide.yml +++ b/.github/workflows/update-lucide.yml @@ -134,8 +134,12 @@ jobs: env: GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} run: | - echo "🔍 Generating semantic search data for new icons..." - make search-data + if [ -z "$GEMINI_API_KEY" ]; then + echo "⚠️ GEMINI_API_KEY not set — skipping search data so the icon update can still land. New icons will be missing from semantic search until the key is restored." + else + echo "🔍 Generating semantic search data for new icons..." + make search-data + fi SEARCH_DB=src/lucide/data/lucide-search.db if [ -f "$SEARCH_DB" ]; then DESC_COUNT=$(sqlite3 "$SEARCH_DB" "SELECT COUNT(*) FROM icon_descriptions;") From 96b2b6868115b40ededd83ca3cdabbefc4285fbb Mon Sep 17 00:00:00 2001 From: Mike Macpherson Date: Mon, 20 Jul 2026 11:04:32 -0700 Subject: [PATCH 2/3] ci: auto-file a ci-failure issue when housekeeping workflows fail MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Part of a cross-repo change (mmacpherson/mikemac#90): PR-producing workflows open (or comment on) a 'ci-failure'-labeled issue on failure so a dead updater can't masquerade as a quiet week — this exact workflow was dead for 5 weeks before anyone noticed. Co-Authored-By: Claude Fable 5 --- .github/workflows/update-lucide.yml | 19 +++++++++++++++++++ .../workflows/update-pre-commit-hooks.yaml | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/.github/workflows/update-lucide.yml b/.github/workflows/update-lucide.yml index 659e33d..9af71a2 100644 --- a/.github/workflows/update-lucide.yml +++ b/.github/workflows/update-lucide.yml @@ -13,6 +13,7 @@ jobs: permissions: contents: write pull-requests: write + issues: write steps: - name: Checkout repository @@ -265,3 +266,21 @@ jobs: else echo "- **Status**: ✅ Already up to date" >> $GITHUB_STEP_SUMMARY fi + + - name: Open issue on failure + if: failure() + env: + GH_TOKEN: ${{ github.token }} + run: | + title="CI failure: ${{ github.workflow }}" + run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" + existing=$(gh issue list --repo "${{ github.repository }}" --label ci-failure --state open \ + --search "\"$title\" in:title" --json number --jq '.[0].number // empty') + if [ -n "$existing" ]; then + gh issue comment "$existing" --repo "${{ github.repository }}" --body "Still failing: $run_url" + else + gh issue create --repo "${{ github.repository }}" --label ci-failure --title "$title" \ + --body "Automated housekeeping workflow failed. Latest run: $run_url + + Surfaced by the /prs weekly review. Close when the workflow is green again." + fi diff --git a/.github/workflows/update-pre-commit-hooks.yaml b/.github/workflows/update-pre-commit-hooks.yaml index 41c2f59..1251cd9 100644 --- a/.github/workflows/update-pre-commit-hooks.yaml +++ b/.github/workflows/update-pre-commit-hooks.yaml @@ -9,6 +9,7 @@ on: permissions: contents: write pull-requests: write + issues: write jobs: update-hooks: @@ -136,3 +137,21 @@ jobs: - name: Clean up if: always() run: rm -f .pre-commit-config.yaml.bak + + - name: Open issue on failure + if: failure() + env: + GH_TOKEN: ${{ github.token }} + run: | + title="CI failure: ${{ github.workflow }}" + run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" + existing=$(gh issue list --repo "${{ github.repository }}" --label ci-failure --state open \ + --search "\"$title\" in:title" --json number --jq '.[0].number // empty') + if [ -n "$existing" ]; then + gh issue comment "$existing" --repo "${{ github.repository }}" --body "Still failing: $run_url" + else + gh issue create --repo "${{ github.repository }}" --label ci-failure --title "$title" \ + --body "Automated housekeeping workflow failed. Latest run: $run_url + + Surfaced by the /prs weekly review. Close when the workflow is green again." + fi From afcc2b9b387ab7c8556c42f5b4da1a366a27eb83 Mon Sep 17 00:00:00 2001 From: Mike Macpherson Date: Mon, 20 Jul 2026 11:13:20 -0700 Subject: [PATCH 3/3] ci: file ci-failure issue when GEMINI_API_KEY is missing, not just on failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The skip-guard made a missing key produce a green run with a buried log warning — the same invisibility that hid the original outage. Missing key now files/comments the ci-failure issue (with the sops recovery pointer) while still letting the icon update land. Co-Authored-By: Claude Fable 5 --- .github/workflows/update-lucide.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/update-lucide.yml b/.github/workflows/update-lucide.yml index 9af71a2..83b67eb 100644 --- a/.github/workflows/update-lucide.yml +++ b/.github/workflows/update-lucide.yml @@ -134,9 +134,22 @@ jobs: if: steps.version-check.outputs.needs-update == 'true' && steps.check-pr.outputs.pr-exists == 'false' env: GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} + GH_TOKEN: ${{ github.token }} run: | if [ -z "$GEMINI_API_KEY" ]; then - echo "⚠️ GEMINI_API_KEY not set — skipping search data so the icon update can still land. New icons will be missing from semantic search until the key is restored." + echo "::warning::GEMINI_API_KEY not set — skipping search data so the icon update can still land. New icons will be missing from semantic search until the key is restored." + # A green run with a buried warning is how the last outage stayed + # invisible for 5 weeks — file the ci-failure issue even on success. + title="CI failure: ${{ github.workflow }} (GEMINI_API_KEY missing)" + run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" + existing=$(gh issue list --repo "${{ github.repository }}" --label ci-failure --state open \ + --search "\"$title\" in:title" --json number --jq '.[0].number // empty') + if [ -n "$existing" ]; then + gh issue comment "$existing" --repo "${{ github.repository }}" --body "Still missing: $run_url" + else + gh issue create --repo "${{ github.repository }}" --label ci-failure --title "$title" \ + --body "GEMINI_API_KEY repo secret is not set. Icon updates still land, but new icons are skipped from semantic search. Restore from sops key PYTHON_LUCIDE_CI_GEMINI_API_KEY (secrets/infrastructure/llm-providers.sops.yaml). Run: $run_url" + fi else echo "🔍 Generating semantic search data for new icons..." make search-data