fix workflows

fix workflows

* feature: detect new pod crashes

* fix: update config.yaml

* feature: detect new pod crashes

* fix: update config.yaml

* fixes alert for ContainerCreating and Completed

* fix welcome message

* feature: detect new pod crashes

* fix: update config.yaml

* fixes alert for ContainerCreating and Completed

* fix welcome message

* 🚀 use github container registry

* update README.md

* feature: add PagerDuty to event providers

* feature: enable and disable providers from config

* fix: pass providers configurations in parameters & update README

* support versioning

* update comments

* update alert config

* fix: update config name

* fix: remove redundant statements

* fix: welcome msg version

* update documentation

* fix: welcome msg version

* update documentation

* feature: select namespaces you want to hear from

* make IsStrInSlice to be more generic

* update config file

* update README.md

* cleanup

* add namespaces to README.md

* support storage to avoid duplicate notifications

* update configs

* fix: escape JSON breaking characters in PagerDuty request body

* chore: add inline comment

* feature: notify periodically on new version updates

* fix: create upgrader package

* chore: add inline comments

* init telegram.go

* feature: support telegram.go

* update README.md

* send custom msg via telegram

* remove debugging logs

* add a photo in README.md and refactor

* PR comments

* fix typo in README.md

* feature: support teams as a provider

* feature: support teams as a provider

* update README.md

* add

* cleanup code

* fix custom msg

* provider to capitals

* refactor sendEvent

* refactor SendMessage

* const title

* feature: support teams as a provider

* feature: support teams as a provider

* update README.md

* add

* cleanup code

* fix custom msg

* provider to capitals

* refactor sendEvent

* refactor SendMessage

* const title

* add image

…st error due to malformed JSON payload (#35)

* ♻️ add tests for memory and util

* improve codebase

* update branch name in docs

* feature: support rocket chat as a provider fixes abahmed/kwatch#25

* readme: update company list

* fix comments in rocketchat.go

Signed-off-by: Thomas Leclaire <tleclaire@solocal.com>

Signed-off-by: Thomas Leclaire <tleclaire@solocal.com>

Bumps [github.com/slack-go/slack](https://github.com/slack-go/slack) from 0.17.3 to 0.18.0.
- [Release notes](https://github.com/slack-go/slack/releases)
- [Changelog](https://github.com/slack-go/slack/blob/master/CHANGELOG.md)
- [Commits](slack-go/slack@v0.17.3...v0.18.0)

---
updated-dependencies:
- dependency-name: github.com/slack-go/slack
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: add telemetry and state management for kwatch

- Add ConfigMap-based state management for first-run detection
- Add anonymous telemetry to track kwatch usage (opt-in)
- Track notified versions to avoid duplicate upgrade notifications
- Add startup manager to clean up main.go
- Add comprehensive tests for new packages
- Update documentation with telemetry config

Features:
- telemetry.enabled: Send cluster ID and version on first run
- notified-version: Track which upgrade version user was notified about
- state configmap: Store cluster-id, version, first-run, telemetry-sent

* feat: run kwatch as non-root user for improved security

- Add kwatch user with UID/GID 1000 in Dockerfile
- Switch to non-root user before running kwatch
- Add securityContext to deploy.yaml (runAsNonRoot, readOnlyRootFilesystem)
- Update Helm chart values.yaml to use UID 1000
- Update README documentation

Addresses issue #411

* feat: add health check endpoint for liveness and readiness probes

- Add HTTP health check server with /healthz and /health endpoints
- Add configurable port (default: 8060) and enabled flag
- Add readiness and liveness probe configuration to deployments
- Update Helm chart with service port and probe settings
- Add tests for health check server
- Update README documentation

Addresses issue #295

* docs: add health check documentation to README

* feat: add node name to all alert provider notifications

- Add NodeName field to event.Event struct
- Update FormatMarkdown, FormatHtml, FormatText methods to include node name
- Populate NodeName from pod spec in executePodFilters and executeContainersFilters
- Update all alert providers to include node name in notifications:
  - Slack, Discord, Teams, Telegram, PagerDuty, OpsGenie
  - Mattermost, Webhook, Email, Zenduty
- Update test files to include NodeName in event structs

Fixes #407

* fix: security, reliability, and performance improvements

Security:
- Fix JSON injection in PagerDuty provider (escape all user fields)
- Fix JSON injection in DingTalk provider (escape title, msg)
- Fix nil response panic in Teams provider
- Add safe type assertion in Webhook provider
- Mask sensitive tokens in Telegram logging

Reliability:
- Add generic retry helper for ConfigMap updates (state/retry.go)
- Update StateManager to use retry logic for all mutations
- Add graceful shutdown handling in main.go
- Add PVC monitor cleanup to prevent memory leaks

Performance:
- Add generic HTTP client with 30s timeout (util/http.go)
- Update all 12 alert providers to use timeout-enabled client

Minor fixes:
- Add Content-Type header to Zenduty requests
- Fix Webhook error message ('teams' -> 'webhook')
- Fix Telegram log message ('initializing  with' -> 'initializing webhook with')
- Add mutex to PVC monitor for thread safety

* fix: chunk long events in Discord to prevent API limits

Events can exceed Discord's 6000 char message limit. Added chunking
to split events into 1024-char segments, similar to Slack provider.
Also added test coverage for the chunks function.

* fix: add mutex lock to checkUsage() for thread safety

The checkUsage() function was reading and writing to notifiedPvc map
without acquiring the mutex, causing a race condition with the cleanup()
function. Added mutex lock/unlock to protect all notifiedPvc access.

* fix: add nolint:gosec to suppress CodeQL false positives

CodeQL flags json.Marshal usage as potentially unsafe quoting.
These are false positives since json.Marshal properly escapes all
special characters (quotes, newlines, backslashes, etc).

Added //nolint:gosec comments to suppress warnings after manual
security review confirms the code is safe.

* fix: use json.Marshal for DingTalk instead of fmt.Sprintf

Refactor SendEvent and SendMessage to use structs with json.Marshal
instead of fmt.Sprintf with JsonEscape. This satisfies CodeQL
security checks and is the recommended approach for building JSON payloads.

* fix: use json.Marshal for PagerDuty and Telegram

Refactor PagerDuty and Telegram providers to use structs with
json.Marshal instead of fmt.Sprintf with JsonEscape. This satisfies
CodeQL security checks.

Changes:
- PagerDuty: Added pagerdutyPayload struct and refactored
  buildRequestBodyPagerDuty to return (string, error)
- Telegram: Added telegramPayload struct and refactored
  buildRequestBodyTelegram

* fix: correct JSON key from 'attachment' to 'attachments' in Teams (#403)

* Mark Telemetry and Health Check as Not Released in README

* 🧪📦🔧 Improve test coverage across multiple packages

- Add tests for event, filter, handler, client, watcher, pvcmonitor packages
- Improve coverage for upgrader, state, startup, telemetry, util packages
- Refactor watcher package with WatchInterface and WatcherFactory for better testability
- Add mock types for testing k8s watch operations
- Fix deprecated workqueue.New and toolsWatch.NewRetryWatcher usage
- Update health.NewHealthServer to accept config.HealthCheck struct

Coverage improvements:
- event: 0% → 100%
- filter: 0% → 91.4%
- handler: 0% → 94.8%
- client: 0% → 78.3%
- watcher: 25% → 44.7%
- pvcmonitor: 0% → 31.6%
- upgrader: 3.6% → 68.8%
- state: 80% → 91.4%
- startup: 76.9% → 84.6%
- telemetry: 87% → 91.3%
- util: 79.6% → 87%

* 🗑️ Remove coverage.html file

* 🔧 Fix data race in watcher tests

Use atomic counter and mutex for thread-safe test assertions

* 📚🧹📝 Clean up README: remove architecture section & fix Google Chat typo

* 📦⬆️ Bump stretchr/objx from 0.5.2 to 0.5.3

* 🔄🧹✨ Refactor controller, handler errors, resync & remove telemetry

🔄 Replace watcher package with SharedInformerFactory + TypedRateLimitingInterface controller
   - controller/controller.go: standard informer event handlers, workqueue workers, cache sync
   - Removed watcher/start.go, watcher/watcher.go, watcher/watcher_test.go

⚠️ Handler methods now return error for transient failures
   - ProcessPod/ProcessNode/ProcessPodObject/ProcessNodeObject return error
   - Transient errors (cache misses, API failures) trigger requeue with backoff
   - Permanent outcomes (filtered, deleted, alert sent) return nil

🔁 Add configurable resync period (config.resyncSeconds)
   - Default 0 = event-driven only, no periodic resync
   - Ensures missed events are eventually re-processed

🧹 Remove telemetry subsystem entirely
   - Deleted telemetry/ package
   - Removed from config, state, startup, constant, deploy configs, docs
   - Removed IsTelemetrySent/MarkTelemetrySent from StateManager
   - Simplified StartupManager constructor (removed telemetryCfg param)

📝 Clean up unused Controller.client field, update deploy configs and READMEs

* 🧹🗑️ Remove liveness & readiness probes from deploy templates

🧹 Probes removed from deploy/deploy.yaml and Helm chart deployment template
🗑️ Removed readinessProbe and livenessProbe config from values.yaml and chart README
✅ restartPolicy: Always kept (explicit for clarity)

Probes were pointless for kwatch:
- Readiness: no inbound traffic to route, no Service in deploy
- Liveness: health server goroutine runs independently of controller loop
  (stuck controller still gets 200 OK from /healthz)

K8s restarts containers automatically when the process exits.

* 🔧 Restore volumeMounts and env in Helm chart template

* 🧪🔧 Fix data race in controller tests

Mock handler podKeys/podDel/nodeKeys/nodeDel slices were accessed
concurrently by the controller worker goroutine and the test goroutine
without synchronization, causing -race failures in CI.

Added sync.Mutex to mockHandler and thread-safe accessor methods
(podCount, nodeCount, podEntry, nodeEntry).

* 🎉 release v0.10.5

* 📝 Remove '(Not Released)' from Health Check heading in README

* 💬 Add Slack bot token support (alternative to webhooks)

Support Slack App bot tokens (xoxb-...) with channel-based posting
as an alternative to incoming webhook URLs.

Config:
  alert.slack:
    token: xoxb-...      # bot token
    channel: #alerts      # required with token

Existing webhook config continues to work unchanged:
  alert.slack:
    webhook: https://hooks.slack.com/...

Uses slack-go/slack PostMessage API for token mode,
PostWebhook for webhook mode. Both produce identical
message block formatting.

…ds and fix startup notification message (#437)

* 🔧 Refactor to follow Kubernetes project structure and logging standards

- 🗂️ Restructure to use cmd/, internal/, hack/, third_party/ directories
- 📦 Move main.go to cmd/kwatch/
- 🔖 Rename packages: k8sutil→k8s, alertmanager→alert, pvcmonitor→pvc
- 📝 Use underscores for file/directory names per K8s conventions
- 📚 Migrate from logrus to klog (K8s standard logging)
- 🛠️ Add Makefile with K8s-style targets
- 🐳 Update Dockerfile to build from ./cmd/kwatch

* fix: interpolate version in startup notification message

* fix: use json.Marshal to fix CodeQL security alert in matrix

… (#455)

* feat: incident enrichment, lifecycle management, and Slack thread support

- Add IncidentState (Active/Stale/Resolved) and IncidentAction (Create/Update/Skip/Stale/Resolved)
- Add enriched fields to Incident: OwnerKind, ContainerName, RestartCount, Hint, State, LastUpdate
- Add Enricher interface + DefaultEnricher + hintForReason mapping
- Correlation engine: new key format (ns:owner:reason:container), normalizeReason(),
  lifecycle ticker, RemovePod/MarkResolved, LifecycleHook (called outside lock)
- Config: StaleThreshold (default 15m), LifecycleInterval (default 1m)
- Handler: populate OwnerKind/RestartCount, call RemovePod on delete
- Slack provider: threaded incident messages via postBlocksFn for all 5 actions,
  enriched blocks (OwnerKind, ContainerName, RestartCount, Hint), threadMap + mutex
- Alert layer: ThreadProvider interface, per-action formatting, webhook fallback
- NoiseFilter: skip Normal/Scheduled/Pulled/Pulling events pre-correlation

* docs: add correlation, noise filter, and Slack incident mode to README

* fix: scope ConfigMap permissions to kwatch namespace instead of cluster-wide

Removes 'configmaps' from the ClusterRole and adds a namespace-scoped
Role + RoleBinding for ConfigMap access (get/create/update/patch) in
the kwatch namespace. This follows the principle of least privilege
and prevents an attacker from manipulating ConfigMaps in other
namespaces (e.g. CoreDNS) if the kwatch pod is compromised.

Fixes #445

Bumps alpine from 3.20 to 3.24.

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: '3.24'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>