fix(runner/alerts): stop leaking internal matcher names into finding descriptions - #552
Merged
Merged
Conversation
…descriptions The stored event description for every trigger-matched finding was the placeholder "Trigger '<matcher>' matched on agent (raw event in evidence)" — internal trigger vocabulary (babysitter_deployment, ...) rendered verbatim in the UI and in AI-investigation evidence, where it reads as noise and misleads. Descriptions now say what happened on the cluster per aggregation key (config change with spec diff attached, CrashLoopBackOff, OOMKilled, image pull failure, ...).
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Description() method of MatchedTrigger in runner/pkg/alerts/finding.go to return user-friendly, operator-oriented descriptions based on the AggregationKey instead of internal matcher/trigger names. I have no feedback to provide as there are no review comments.
blue4209211
approved these changes
Jul 30, 2026
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Before: every trigger-matched finding stored the description
Trigger 'babysitter_deployment' matched on agent (raw event in evidence)(or the equivalent for other matchers). That internal trigger name renders verbatim in the event UI and is fed into AI-investigation evidence, where it reads as noise and is misleading — it describes the watcher, not what happened.Now:
MatchedTrigger.Description()returns an operator-facing one-liner per aggregation key, mirroring howTitle()already switches — e.g. a configuration change says the resource's spec was changed and points at the attached diff; CrashLoopBackOff, OOMKilled, ImagePullBackOff, job failure, node conditions, and service-no-endpoints each get a plain-language description. Internal matcher names no longer appear anywhere user-facing.Existing stored events keep their old description; new findings pick this up on the next agent release.
How Has This Been Tested?
make testinrunner/— full suite green.go vetclean for the changed package (the one gosec finding is pre-existing inpkg/observability/signoz, untouched here).