GitHub

FileMage Mailbox → Slack Notifier

Posts a Slack message whenever a partner uploads a new file into a watched folder of the FileMage mailbox bucket (thb-sftp-mailbox-*, see the FileMage SFTP Gateway runbook).

How it works: an Eventarc storage OBJECT_FINALIZE trigger on the bucket invokes the sftp-mailbox-notifier gen2 Cloud Function. It reads a token-free routing config (prefix→channel) from a mounted secret, takes the Slack bot token from the shared slack_api_token secret, and posts a message with a link to the file in the GCS console. It never reads the bucket.

  • Terraform: infra/common-infra/business_unit_1/shared/sftp_mailbox_notifier.tf
  • Function source: infra/common-infra/cloudfunctions/bucket_slack_notifier/
  • Project: prj-bu1-c-common-infra-c4aa; Slack token: slack_api_token in prj-c-secrets-a7cc

The function is deployed from source — Terraform zips the code and Cloud Build builds it on apply, so there is no image to build or tag to pin.

Add or change a watched folder

Routing lives in the sftp-mailbox-notifier-config secret — no code or Terraform change needed. Edit config.yml (schema in infra/common-infra/cloudfunctions/bucket_slack_notifier/config.example.yml) and upload a new version:

gcloud secrets versions add sftp-mailbox-notifier-config \
  --data-file=config.yml --project=prj-bu1-c-common-infra-c4aa

The function reads version = latest on the next cold start; redeploy to pick it up immediately if needed.

  • Rules match by object-name prefix (longest match wins).
  • ignore_suffixes (global or per-rule) skips temp-then-rename uploads (.filepart, .tmp, …) so a partial file’s 404-ing link is never posted.
  • Message tokens: {name}, {url}, {bucket}, {size}, {content_type}.

The Slack bot needs chat:write and must be a member of every target channel. The token comes from the shared slack_api_token secret, so rotating it there updates every consumer at once.

Deploy code changes

Just edit the Go under infra/common-infra/cloudfunctions/bucket_slack_notifier/ and apply via the standard infra workflow (./zig/zig build plan -- common-infra, then apply). The content-addressed source object redeploys the function when the code changes.

Test locally

cd infra/common-infra/cloudfunctions/bucket_slack_notifier
go test ./...

# Run under the Functions Framework, logging instead of posting:
DRY_RUN=1 CONFIG_PATH=config.example.yml go run ./cmd/local
# then POST a structured storage CloudEvent to http://localhost:8080/

Troubleshooting

  • No message on upload. Confirm the object prefix matches a rule, the bot is in the channel, and it isn’t a temp/ignore_suffixes name. Check the Eventarc trigger exists: gcloud eventarc triggers list --location=us-central1 --project=prj-bu1-c-common-infra-c4aa.
  • Messages retrying. Inspect the function logs (gcloud functions logs read sftp-mailbox-notifier --gen2 --region=us-central1); a returned error nacks the event and Eventarc retries with backoff. There is no dead-letter topic — a dropped Slack ping isn’t the source of truth.
  • Duplicate messages. Dedup is best-effort per instance; a rare duplicate after a cold start is expected and low-harm.
  • Deploy failed at build. The build runs as the dedicated sftp-mailbox-notif-build SA (the project’s default compute SA is disabled by org policy). Check its Cloud Build logs.
Edit this page