* stage 11: GitHub Action + Slack/webhook notifier
Add a distribution channel and an output sink for unattended ZERO runs.
internal/notify:
- Add a Sink interface and Notifier fan-out. Notify now emits the terminal
bell/OSC-9 sequence AND forwards every eligible event to attached sinks.
Sinks fire even with no terminal writer (headless CI) and are gated by the
same mode/focus policy. Sink invocation happens outside the lock and a sink
panic is isolated, so a misbehaving or slow sink can never crash or stall the
run. New(w, cfg) stays backward compatible.
- Add a WebhookSink (slack.go) that POSTs a JSON payload
{text, type, message, summary?, links?} to a Slack incoming webhook or any
generic webhook. Delivery is best-effort and fails soft: non-2xx and
transport errors are logged (redacted) and swallowed. The message, summary,
links, and the webhook URL are run through redaction before send/log so
tokens never leak. The default HTTP transport honors HTTP(S)_PROXY, so a
sandboxed run's scoped-egress policy is respected. An empty URL is inert.
action.yml:
- Composite GitHub Action wrapping zero exec. Provider-agnostic: provider,
api-key, and api-key-env are inputs (no provider is hardcoded). Installs the
pinned ZERO release via the bundled checksum-verifying installer, runs the
prompt in the checked-out repo, surfaces ZERO's exit code as the step status,
captures stdout, and can post a summary to the PR or to Slack. Safety
defaults: auto=low, sandbox always active, never passes
--skip-permissions-unsafe; secrets are passed via env and never echoed.
docs/GITHUB_ACTION.md: input/output tables, copy-paste workflows (issue-labeled
triage and nightly dep-upgrade PR), security notes, and the notifier docs.
.github/workflows/zero-action-smoke.yml: validates action.yml parses, declares
the documented inputs/outputs, keeps the conservative defaults, never enables
unsafe mode, and shell-syntax-checks the embedded run blocks.
* stage 11: reword action.yml comment so the unsafe-flag validation passes
The composite step's shell comment contained the literal '--skip-permissions-unsafe', which the action-yml validation (assert the string never appears in the serialized doc, to prove the flag is never passed) flagged even though it was only descriptive. Reworded the comment to drop the literal; the action still never passes the flag and the check stays strict.
* stage 11: address review for action env/inputs and webhook URL redaction
- action.yml: reject prompt+prompt-file when both set; trim only surrounding
whitespace from add-dir entries (preserve internal spaces); export api-key
in-process (validated env name) so the run sees it; treat a commit-SHA
action_ref as not-a-tag and fall back to latest.
- notify: redact the webhook URL in outbound payload fields (not just logs);
copy caller-owned Links/ExtraSecrets slices in the constructor.
* stage 11: disable credential persistence in action smoke checkout
