SecondShift v0.1.0b6

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0b6-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0b6-py3-none-any.whl
secondshift up

SecondShift 0.1.0b6

This beta lets a webhook start a job, for example when an alert fires. The run
can read the request body. Repeated and resolved alerts don't start new runs.
A Grafana recipe and a sample alert-triage skill show the whole setup.

Webhook triggers

A job with triggers: [webhook] gets its own URL and secret on the job page.
The configuration never holds the URL or the secret (#158).

• A request passes with Authorization: <scheme> <secret>, or with an
  HMAC-SHA256 signature in X-SecondShift-Signature. With
  X-SecondShift-Timestamp, the signature covers the timestamp too, and old
  requests are refused.
• The secret is shown once, when the trigger is turned on or rotated.
• A refused request gets a reason, such as wrong credentials, a job that isn't
  ready, or a run still going. The job page lists recent requests.
• A job runs one at a time. Run now and triggers refuse while a run is active.
  A scheduled tick is skipped and noted on the active run.
• Each run shows what started it: schedule, manual or webhook.
• Owners and admins manage triggers. Members can see them.

See Webhook triggers.

The request body reaches the run

A webhook run can read the request body with the trigger_payload tool. The
body is marked as untrusted data, like other tool results. The first 64 KiB is
stored with the run and shown on the Input tab. Senders should not put secrets
in it (#159).

Fewer runs from noisy alerts

An optional webhook block in the job decides which requests to ignore (#160).

webhook:
  skip_when:
    status: resolved
  repeat_key: groupKey
  repeat_window: 2h

• skip_when ignores a request when every listed field matches.
• repeat_key names the field that identifies an event. A repeat is ignored
  while its run is active, and for repeat_window after it ends.
• Ignored requests get 200, so senders don't retry them.
• Each trigger starts at most 10 runs an hour. Owners and admins can change
  this per trigger, up to a server ceiling.

Included

• Missing optional bindings. The run prompt lists the optional bindings a
  run doesn't have, and why: not connected, waiting for approval, denied or
  not available. A report can tell a missing source from one that found
  nothing (#157).
• Grafana recipe. How to run mcp-grafana read-only, connect it, and point
  a Grafana contact point at a job. See
  Example: Grafana (#161).
• Alert-triage sample. A skill that reads the alert, checks metrics, logs
  and errors around its start, and reports a likely cause. It was tested end
  to end with Grafana, Loki and Prometheus. See
  examples/alert-triage (#162).

New settings

• SECONDSHIFT_TRIGGER_MAX_RUNS_PER_HOUR is the default hourly run limit for
  each trigger. Default 10.
• SECONDSHIFT_TRIGGER_MAX_RUNS_PER_HOUR_CEILING is the highest limit an owner
  can choose. Default 60.

A Grafana or other sender running in Docker may reach SecondShift at a host
name like host.docker.internal. Add it to SECONDSHIFT_ALLOWED_HOSTS.

Upgrade compatibility

From beta 5, keep your existing data, private configuration and encryption
keys. Install the new wheel or update the pinned container image to
ghcr.io/piotrekno1/second-shift:0.1.0b6. Then run the normal migration
commands. This release adds five migrations:
jobs.0005_job_triggers, jobs.0006_job_webhook,
runs.0002_run_started_by, triggers.0001_initial and
triggers.0002_ignored_events_and_hourly_limit. They add a new app's tables
and columns with defaults. Existing jobs have no triggers, and their
configuration hashes don't change. Runs from before the upgrade don't record
what started them.

From older alpha builds, fresh databases are still required. Follow the
beta 1 upgrade instructions.

Limitations

The tests use stand-ins for GitHub, the model provider and S3. Real GitHub.com
and model providers, public HTTPS certificates, and production S3 permissions
still need checking on your own deployment. See the
deployment guide.

What's Changed

• Point install docs at 0.1.0b5 by @piotrekno1 in #148
• Tell the skill which optional bindings are missing by @piotrekno1 in #157
• Start a job from an inbound webhook by @piotrekno1 in #158
• Pass the trigger payload to the run by @piotrekno1 in #159
• Collapse repeated and resolved alerts by @piotrekno1 in #160
• Grafana recipe: mcp-grafana and alert webhooks by @piotrekno1 in #161
• Sample alert-triage skill, tested end to end by @piotrekno1 in #162
• Release 0.1.0b6 by @piotrekno1 in #166

Full Changelog: v0.1.0b5...v0.1.0b6