Slack app
The Updawg Slack app posts your proposals to the channels you choose, with
buttons to act on them, and keeps each message up to date as the proposal
rolls out. Your team can ask about the fleet with /updawg, see what waits
on them in the app’s Home tab, and discuss a proposal in its Slack thread,
which becomes the proposal’s comments in Updawg.
It is included from the Team plan. On Free, notifications go by email.
Add Updawg to Slack
Section titled “Add Updawg to Slack”An admin or owner of the organization:
- Opens Settings → Notifications and presses Add to Slack on the Slack app card.
- Chooses the Slack workspace and allows the app. Slack sends you back to Updawg, which says whether it worked.
One organization can be added to several workspaces, and one workspace can have the app for several organizations.
Choose channels
Section titled “Choose channels”Under Settings → Notifications, add a channel of kind Slack app, pick the workspace and then the channel from the list of its public channels. As with any channel, the notification rules decide which events go there.
Updawg joins a public channel when you choose it, and the channel form says so. Being in the channel is what lets replies in a proposal’s thread reach Updawg: Slack only tells an app about messages in channels it is in.
Apps cannot join private channels. For a private channel, invite the app
first (/invite @Updawg in the channel), then choose Type a channel name or
ID and enter it. If you save a private channel the app is not in yet, the
form tells you to invite it.
A workspace that added Updawg before it could join channels by itself is asked to add it to Slack again, from the same card.
Proposals in Slack
Section titled “Proposals in Slack”Each proposal gets one message per channel, edited as the proposal moves, rather than a new message for every event: opened, approved and by whom, rolling out (“12 of 40 hosts done”), done, halted. A host whose job fails is named in the message’s thread.
The message carries the buttons that apply to the proposal as it is now:
| Button | Who may use it | Notes |
|---|---|---|
| Approve | Operators and up | Only when the organization allows approvals from Slack |
| Reject | Operators and up | Asks for the reason, which everybody in the organization sees |
| Snooze | Operators and up | For a day or a week |
| Halt | Operators and up | Always there while a rollout runs |
| Resume | Operators and up |
Rolling a proposal back is done in Updawg.
Link your Slack account
Section titled “Link your Slack account”The first time you press a button, use /updawg or reply in a proposal’s
thread, the app answers privately with Link my account. It opens Updawg,
which shows the Slack account and the workspace and asks you to sign in as
you normally do and confirm. From then on, what you do in Slack is done as
you, with your role, and the audit log says it came from Slack.
- Updawg never matches Slack accounts to people by email address: a workspace admin can give any Slack account any address.
- A link ends when you leave the organization or the app is removed from the workspace.
- Settings → Notifications → Your Slack account shows your link and unlinks it. Admins see everybody’s links there and can remove any of them.
Approvals from Slack
Section titled “Approvals from Slack”Off by default. An admin turns on Allow approvals from Slack on the Slack app card. Until then the Approve button is not shown, and everything else (reject, snooze, halt, resume, comment) works with a linked account.
It is off by default because approving starts changes on your hosts, and a Slack session is not your Updawg sign-in: your organization’s identity provider and its sign-in rules may not govern it. An approval from Slack counts towards the approvals a policy requires like any other.
Ask with /updawg
Section titled “Ask with /updawg”| Command | Answers with |
|---|---|
/updawg status |
Hosts, pending security updates, proposals waiting, rollouts halted |
/updawg host web-01 |
One host: its system, when it last checked in, its updates and open proposals |
/updawg cve CVE-… |
Which hosts are exposed, and whether a fixed version is available |
/updawg pending |
Proposals waiting on you, with their buttons |
/updawg help |
The commands |
Answers are visible only to you. Add share at the end to post the answer in
the channel instead (operators and up). In a workspace that has the app for
more than one organization, the first command in a channel asks which
organization it is about, and remembers the answer for that channel.
The Home tab
Section titled “The Home tab”Open the Updawg app in Slack to see, for each organization the app is in there, a summary of the fleet and the proposals waiting on you, with links to them in Updawg.
Link previews
Section titled “Link previews”A link to Updawg pasted in Slack (the dashboard, a host, a proposal or the
advisories, with its ?org= part) unfolds into a short summary, when the
person who pasted it has linked their account to that organization. Anything
else stays a plain link.
A proposal’s thread is its comments
Section titled “A proposal’s thread is its comments”- A reply in the thread under a proposal’s message, by somebody with a linked account, is saved as their comment on the proposal. Mentioning a linked colleague in Slack mentions them in Updawg too. Somebody without a link is offered one, privately, and their reply is not saved.
- A comment written in Updawg is posted in the proposal’s threads, as “Name (in Updawg): …”. A colleague it mentions who has linked their account is mentioned in Slack.
- Editing a reply in Slack does not change the comment: comments in Updawg are a record and are never edited. The app says so, privately.
- Deleting a reply in Slack removes the comment it became, and the app’s copies of it in other channels.
Nothing said in a channel outside a proposal’s thread is read by Updawg.
What the app asks Slack for, and why
Section titled “What the app asks Slack for, and why”| Scope | Why |
|---|---|
chat:write |
Post and update proposals’ messages and replies |
chat:write.public |
Post to a public channel without being invited first |
channels:read |
List public channels for the channel picker |
channels:join |
Join the public channels it posts to, so replies there reach it |
channels:history |
Receive replies in proposals’ threads in public channels |
groups:history |
The same, in private channels the app was invited to |
commands |
/updawg |
links:read |
Know when a link to Updawg is pasted |
links:write |
Show its preview |
users:read |
Show the name of the person a link offer or a mention is for |
The app does not read channel history: the two history scopes are what
Slack requires for the app to be told about new replies, and only replies in
a proposal’s thread are looked at.
What Updawg stores
Section titled “What Updawg stores”- For each workspace the app is in: its ID and name, the app’s bot user, and the bot token, encrypted with your organization’s notification key.
- For each linked account: the Slack user ID and name, and the member it is linked to.
- For each proposal’s message and each comment’s reply: the channel ID and Slack’s message timestamp, so it can edit or find it later.
- Replies in a proposal’s thread are stored as comments, like any other comment. No other Slack message is stored.
All of it is kept in your organization’s region. Organizations in the US region use a separate app, so their Slack data never passes through the EU.
Remove the app
Section titled “Remove the app”In Updawg, Remove on the Slack app card. In Slack, remove the app from the workspace’s settings: Updawg is told and removes the installation too. Either way the workspace’s linked accounts go with it, and Slack app channels for that workspace stop delivering until it is added again.