Troubleshooting and FAQ

On this page

No issues after the first scan
A tool pinned to latest
Settings are not applied
A command is refused, or nothing happens
Slack is not posting
Other questions

The usual causes, in the order worth checking. Still stuck? Write to info@progrex.dev; or reply /stackpaw wrong … on an issue that is off.

No issues after the first scan#

Most often this is good news: every tool Stackat recognised is on its latest stable release. Otherwise, check:

The scan has run. The dashboard's Overview says "Scanned … ago". The first scan comes within 15 minutes of installing; until then Overview shows a getting-started checklist. If it says "Waiting for approval", the Stackat team approves the installation first.
Release notes still being read. An issue is opened only once every release between your version and the latest has been read. For a tool far behind, that can take a while after the first scan; Stackat checks every 15 minutes.
The repository is in scope. The app must be given the repository (organisation Settings → GitHub Apps → Configure). Archived repositories are not scanned. On the free plan only one repository is; the dashboard names the others under "Not scanned on the free plan".
scan leaves the files out. Check the dashboard's Settings tab for what each repository scans, and scan in the organisation's file too: its exclude applies to every repository.
A cooldown holds it. With a cooldown, a tool whose newer releases are all younger than the cooldown gets no issue yet.
Someone replied /stackpaw ignore on an earlier issue for the tool. Reply /stackpaw track on that issue to undo it.
The tool is not one Stackat follows, or is your own image. Images of your own applications never get issues.
No version to compare. See the next question.

A tool pinned to latest#

An image pinned to latest, to no tag at all, or by digest only (traefik@sha256:…) names no version, so Stackat cannot tell which release you run and opens no issue for it. The same goes for any pin whose version cannot be read.

Pin a version tag instead. You can keep the digest for immutability: Stackat reads traefik:v3.2.0@sha256:… as 3.2.0 and checks the digest against the builds it knows.

deployment.yamlyaml

containers:
  - name: traefik
    image: traefik:v3.2.0     # not traefik:latest

Tags like v2.10.6 and 2.10.6-alpine both pin 2.10.6.

Settings are not applied#

Look at the dashboard's Settings tab. It lists, per repository, what the settings change, Read from: the files they came from, and any problems. A setting with a problem is ignored; the rest apply. See When the file has a problem.
Wait for the next scan. Settings are read at each scan (once a day). A command on an issue scans that repository straight away.
File name and place. .stackat.yml in the repository's top folder, on its default branch. If both .stackat.yml and the old .semapi.yml exist, only .stackat.yml is read.
The organisation's file lives in a repository named .github, .gitlab or stackat-config, and the app must be able to read it. On an installation with selected repositories, add that repository to the selection.
The repository's file wins. A key set in the repository replaces the organisation's; see how the two files merge. values is read from the repository's file only.
A misspelled key (autopr, cooldwn) is ignored without a problem: compare with the option list.
Pull requests with auto_pr: true but none open? They need Stackpaw (not Audit), and the trial or Team (not the free plan). See Pull requests.

A command is refused, or nothing happens#

A one-line refusal ("@bob: only @acme/platform-team … can ask for pull requests in this repository (commands in .stackat.yml).") means commands limits that command. Ask someone listed, or change the list.
"nobody can … in this repository": the list for that command is empty or cannot be read. If the settings file itself is broken and has a commands: key, nobody can use pr, ignore/track or reevaluate until it is fixed; the Settings tab says so.
Team entries never match while the app lacks the Members (read-only) permission; the Settings tab shows "team rules need the app's Members (read) permission". List people or roles meanwhile.
No answer at all:
- the command must start a line, on a Stackat issue (labelled stackat);
- give it about two minutes;
- on a public repository, comments from people without a role in the repository are ignored silently.
/stackpaw pr answers but opens nothing: the reply says why (Stackpaw Audit, the free plan, permissions not accepted yet, a pull request already open). See Pull requests.

Slack is not posting#

Press "Send a test message" on the dashboard's Settings tab. If Slack refuses it, the box says why, for example "The webhook's channel is archived: unarchive it, or connect another channel." or "Slack does not know this webhook any more: it was removed, or the address is mistyped." Reconnect with Add to Slack (or a new webhook).
Only new issues are announced, once each, and only those that meet what gets sent: a security fix at or above your threshold, an exploited vulnerability, or (if ticked) changes needed in your files. A quiet scan sends nothing.
The weekly digest comes on Mondays at 07:00 UTC, if Weekly digest on Mondays is ticked and at least one repository has been scanned. A week missed until Wednesday is skipped, not sent late.
Your workspace blocks apps: use the incoming webhook instead.
Only an organisation owner (an administrator of every repository Stackat can read) can connect or change Slack.