ci: alert agenthook for releases and deploys

.github/workflows/agenthook-notify.yml

@@ -0,0 +1,50 @@
+name: Notify agenthook
+
+on:
+  workflow_call:
+    inputs:
+      kind:
+        description: Event category for the receiving agent.
+        required: true
+        type: string
+      results:
+        description: JSON object containing prerequisite job results.
+        required: true
+        type: string
+    secrets:
+      AGENTHOOK_URL:
+        required: true
+      AGENTHOOK_TOKEN:
+        required: true
+      AGENTHOOK_TOPIC:
+        required: true
+
+permissions: {}
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify agenthook
+        env:
+          AGENTHOOK_URL: ${{ secrets.AGENTHOOK_URL }}
+          AGENTHOOK_TOKEN: ${{ secrets.AGENTHOOK_TOKEN }}
+          AGENTHOOK_TOPIC: ${{ secrets.AGENTHOOK_TOPIC }}
+          EVENT_KIND: ${{ inputs.kind }}
+          RESULTS: ${{ inputs.results }}
+        run: |
+          status=$(jq -r '[.[] | .result] | if index("failure") then "failure" elif index("cancelled") then "cancelled" else "success" end' <<< "$RESULTS")
+          curl --fail --silent --show-error --retry 3 \
+            --request POST \
+            --header "Authorization: Bearer ${AGENTHOOK_TOKEN}" \
+            --header "Content-Type: application/json" \
+            --data "$(jq -nc \
+              --arg kind "$EVENT_KIND" \
+              --arg status "$status" \
+              --arg repo "$GITHUB_REPOSITORY" \
+              --arg branch "$GITHUB_REF_NAME" \
+              --arg sha "$GITHUB_SHA" \
+              --arg run_url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+              --argjson results "$RESULTS" \
+              '{kind:$kind,status:$status,repository:$repo,branch:$branch,sha:$sha,run_url:$run_url,results:$results}')" \
+            "${AGENTHOOK_URL}/v1/webhooks/${AGENTHOOK_TOPIC}"

.github/workflows/ci.yml

@@ -155,26 +155,8 @@ jobs:
   notify-agenthook:
     needs: [unit, windows-process-cleanup, e2e, windows-e2e]
     if: always()
-    runs-on: ubuntu-latest
-    steps:
-      - name: Notify agenthook
-        env:
-          AGENTHOOK_URL: ${{ secrets.AGENTHOOK_URL }}
-          AGENTHOOK_TOKEN: ${{ secrets.AGENTHOOK_TOKEN }}
-          AGENTHOOK_TOPIC: ${{ secrets.AGENTHOOK_TOPIC }}
-          STATUS: ${{ contains(needs.*.result, 'failure') && 'failure' || contains(needs.*.result, 'cancelled') && 'cancelled' || 'success' }}
-          RESULTS: ${{ toJson(needs) }}
-        run: |
-          curl --fail --silent --show-error --retry 3 \
-            --request POST \
-            --header "Authorization: Bearer ${AGENTHOOK_TOKEN}" \
-            --header "Content-Type: application/json" \
-            --data "$(jq -nc \
-              --arg status "$STATUS" \
-              --arg repo "$GITHUB_REPOSITORY" \
-              --arg branch "$GITHUB_REF_NAME" \
-              --arg sha "$GITHUB_SHA" \
-              --arg run_url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
-              --argjson results "$RESULTS" \
-              '{kind:"ci",status:$status,repository:$repo,branch:$branch,sha:$sha,run_url:$run_url,results:$results}')" \
-            "${AGENTHOOK_URL}/v1/webhooks/${AGENTHOOK_TOPIC}"
+    uses: ./.github/workflows/agenthook-notify.yml
+    with:
+      kind: ci
+      results: ${{ toJson(needs) }}
+    secrets: inherit

.github/workflows/clawhub-publish.yml

@@ -25,3 +25,12 @@ jobs:
       dry_run: false
     secrets:
       clawhub_token: ${{ secrets.CLAWHUB_TOKEN }}
+
+  notify-agenthook:
+    needs: [dry-run, publish]
+    if: always() && (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/'))
+    uses: ./.github/workflows/agenthook-notify.yml
+    with:
+      kind: release
+      results: ${{ toJson(needs) }}
+    secrets: inherit

.github/workflows/docker.yml

@@ -51,3 +51,12 @@ jobs:
             ghcr.io/jo-inc/camofox-browser:latest
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  notify-agenthook:
+    needs: [docker]
+    if: always()
+    uses: ./.github/workflows/agenthook-notify.yml
+    with:
+      kind: deploy
+      results: ${{ toJson(needs) }}
+    secrets: inherit

.github/workflows/mirror-camoufox.yml

@@ -150,3 +150,12 @@ jobs:
             --title "Camoufox backup ${SOURCE_TAG}" \
             --notes-file release-notes.md \
             camoufox-assets/*
+
+  notify-agenthook:
+    needs: [mirror]
+    if: always()
+    uses: ./.github/workflows/agenthook-notify.yml
+    with:
+      kind: release-mirror
+      results: ${{ toJson(needs) }}
+    secrets: inherit

.github/workflows/publish.yml

@@ -109,3 +109,12 @@ jobs:
       - name: Publish standalone MCP package with provenance
         working-directory: mcp
         run: npm publish --provenance --access public
+
+  notify-agenthook:
+    needs: [test, publish]
+    if: always()
+    uses: ./.github/workflows/agenthook-notify.yml
+    with:
+      kind: release
+      results: ${{ toJson(needs) }}
+    secrets: inherit

.github/workflows/telemetry-deploy.yml

@@ -27,3 +27,12 @@ jobs:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           workingDirectory: workers/crash-reporter
+
+  notify-agenthook:
+    needs: [deploy]
+    if: always()
+    uses: ./.github/workflows/agenthook-notify.yml
+    with:
+      kind: deploy
+      results: ${{ toJson(needs) }}
+    secrets: inherit