Files

master c58a236d70 Doctor plugin checks: implement health check classes and documentation

Implement remediation-aware health checks across all Doctor plugin modules
(Agent, Attestor, Auth, BinaryAnalysis, Compliance, Crypto, Environment,
EvidenceLocker, Notify, Observability, Operations, Policy, Postgres, Release,
Scanner, Storage, Vex) and their backing library counterparts (AI, Attestation,
Authority, Core, Cryptography, Database, Docker, Integration, Notify,
Observability, Security, ServiceGraph, Sources, Verification).

Each check now emits structured remediation metadata (severity, category,
runbook links, and fix suggestions) consumed by the Doctor dashboard
remediation panel.

Also adds:
- docs/doctor/articles/ knowledge base for check explanations
- Advisory AI search seed and allowlist updates for doctor content
- Sprint plan for doctor checks documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-27 12:28:00 +02:00

1.9 KiB

Raw Blame History

checkId, plugin, severity, tags

checkId

plugin

severity

Teams Configuration

What It Checks

Verifies that the Microsoft Teams notification channel is properly configured. The check reads Notify:Channels:Teams and validates:

Webhook URL (WebhookUrl): must be set and non-empty.
URL format: validates that the URL belongs to a Microsoft domain (webhook.office.com or microsoft.com).
Enabled flag (Enabled): if explicitly false, reports a warning.

The check only runs when the Notify:Channels:Teams configuration section exists.

Why It Matters

Teams is a common enterprise notification channel. Without a valid webhook URL, notifications about release decisions, policy violations, and security findings cannot reach Teams channels.

Common Causes

Teams webhook URL not set in configuration
Webhook URL is not from a Microsoft domain (malformed or legacy URL)
Teams notifications explicitly disabled
Environment variable not bound to configuration

How to Fix

Docker Compose

environment:
  Notify__Channels__Teams__WebhookUrl: "https://YOUR_TENANT.webhook.office.com/webhookb2/..."

Security note: Teams webhook URLs are secrets. Use Docker secrets or a vault.

Bare Metal / systemd

{
  "Notify": {
    "Channels": {
      "Teams": {
        "WebhookUrl": "https://YOUR_TENANT.webhook.office.com/webhookb2/..."
      }
    }
  }
}

Kubernetes / Helm

notify:
  channels:
    teams:
      webhookUrlSecret: "stellaops-teams-webhook"

To create the webhook in Teams: Channel > Connectors > Incoming Webhook > Create.

Verification

stella doctor run --check check.notify.teams.configured

check.notify.teams.connectivity — tests whether the Teams webhook endpoint is reachable
check.notify.queue.health — verifies the notification delivery queue is healthy

1.9 KiB Raw Blame History