chore: fix-slackbot #427
chore: fix-slackbot #427
Conversation
|
WalkthroughReplaces inline CI setup, caching, and publish steps with three local composite GitHub Actions: Changes
Sequence Diagram(s)sequenceDiagram
participant Workflow as publish.yml
participant Setup as .github/actions/setup
participant PublishRelease as .github/actions/publish-release
participant PublishBeta as .github/actions/publish-beta
participant Slack as slackapi/slack-github-action
participant Pages as github-pages-deploy-action
rect rgb(245,250,255)
Workflow->>Setup: call "Setup Project" (inputs: token, pnpm-cache-folder, node-version-file, ...)
Setup-->>Workflow: setup complete
end
alt release path (published == true)
Workflow->>PublishRelease: call "Publish Release Steps" (publishedPackages, slackWebhook)
PublishRelease->>PublishRelease: format publishedPackages -> output
PublishRelease->>Slack: post formatted payload
PublishRelease->>Pages: deploy api docs (chore: release-api-docs)
PublishRelease-->>Workflow: release done
else beta path
Workflow->>PublishBeta: call "Publish Beta Steps"
PublishBeta->>PublishBeta: run pnpm PR publish command
PublishBeta->>Pages: deploy beta docs (beta commit message)
PublishBeta-->>Workflow: beta done
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
View your CI Pipeline Execution ↗ for commit f932124
☁️ Nx Cloud last updated this comment at |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/publish.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (18.75%) is below the target coverage (40.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #427 +/- ##
=======================================
Coverage 18.75% 18.75%
=======================================
Files 138 138
Lines 27368 27368
Branches 951 951
=======================================
Hits 5132 5132
Misses 22236 22236 🚀 New features to boost your workflow:
|
@forgerock/davinci-client
@forgerock/oidc-client
@forgerock/protect
@forgerock/sdk-types
@forgerock/sdk-utilities
@forgerock/iframe-manager
@forgerock/sdk-logger
@forgerock/sdk-oidc
@forgerock/sdk-request-middleware
@forgerock/storage
commit: |
|
Deployed e0cab0c to https://ForgeRock.github.io/ping-javascript-sdk/pr-427/e0cab0c7f97ced3abfc7073f691879eabf5eb944 branch gh-pages in ForgeRock/ping-javascript-sdk |
📦 Bundle Size Analysis📦 Bundle Size Analysis🚨 Significant Changes🔻 @forgerock/journey-client - 0.0 KB (-82.0 KB, -100.0%) 📊 Minor Changes📈 @forgerock/journey-client - 82.0 KB (+0.0 KB) ➖ No Changes➖ @forgerock/device-client - 9.2 KB 13 packages analyzed • Baseline from latest Legend🆕 New package ℹ️ How bundle sizes are calculated
🔄 Updated automatically on each push to this PR |
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/actions/publish-beta/action.yml (1)
4-7: Remove the deadbranchinput (or actually use it).The action exposes a
branchinput but never consumes it, so callers pass data that’s silently ignored. Please either wire the input into the action logic or drop it from the interface.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/actions/publish-beta/action.yml(1 hunks).github/actions/publish-release/action.yml(1 hunks).github/actions/setup/action.yml(1 hunks).github/workflows/publish.yml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
| { | ||
| "publishedPackages": "${{ steps.slackify.outputs.message }}" | ||
| } |
There was a problem hiding this comment.
Slack payload missing required text (webhook rejects it).
Incoming webhooks expect a text or blocks field; sending { "publishedPackages": "…" } results in invalid_payload, so the notification never lands. Wrap the formatted string under text (or build a proper block) before calling the Slack action.
🤖 Prompt for AI Agents
In .github/actions/publish-release/action.yml around lines 27 to 29, the JSON
payload currently sends { "publishedPackages": "${{
steps.slackify.outputs.message }}" } which Slack incoming webhooks reject
because they require a top-level text or blocks field; replace the payload so it
wraps the message under a "text" key (or construct a "blocks" array) e.g. set
the payload to { "text": "${{ steps.slackify.outputs.message }}" } and ensure
any escaping/quoting matches the YAML/step input format.
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Setup Project |
There was a problem hiding this comment.
There should be nothing different, i just refactored this to be more "clean" and use a composite action that can be reused across steps.
| env: | ||
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | ||
|
|
||
| - run: git status |
There was a problem hiding this comment.
removed this b/c unneccessary
| - name: Publish Release Steps | ||
| if: steps.changesets.outputs.published == 'true' | ||
| uses: slackapi/[email protected] | ||
| with: | ||
| payload-delimiter: '_' | ||
| webhook: ${{ secrets.SLACK_WEBHOOK_URL }} | ||
| webhook-type: webhook-trigger | ||
| payload: steps.changesets.outputs.publishedPackages | ||
|
|
||
| - uses: codecov/codecov-action@v5 | ||
| uses: ./.github/actions/publish-release | ||
| with: | ||
| files: ./packages/**/coverage/*.xml | ||
| token: ${{ secrets.CODECOV_TOKEN }} | ||
|
|
||
| - name: Ensure builds run | ||
| run: pnpm nx run-many -t build | ||
| env: | ||
| NX_CLOUD_DISTRIBUTED_EXECUTION: false | ||
| publishedPackages: ${{ steps.changesets.outputs.publishedPackages }} | ||
| slackWebhook: ${{ secrets.SLACK_WEBHOOK_URL }} |
There was a problem hiding this comment.
Broke this branching out into reusable composite actions
just to clean up this workflow
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/actions/setup/action.yml(1 hunks).github/workflows/publish.yml(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (6)
.github/actions/publish-beta/action.yml (3)
3-7: Remove emptyinputsblock or define real inputsAn empty
inputs:is noise. Either remove it or add explicit inputs (e.g.,token,docs-folder,branch) you plan to consume.
8-11: Ensure auth for PR creation (GITHUB_TOKEN) is wired
pnpm pkg-pr-new publish …will need a token to open PRs. Composite actions don’t auto-inject inputs; rely onGITHUB_TOKENfrom the caller job and ensurepermissions: contents: write, pull-requests: writeare set, or accept atokeninput and pass it as env.Example adjustment within this action:
inputs: + token: + description: 'GitHub token with contents & pull-requests write' + required: false steps: - name: Create PR for beta publish shell: bash - run: pnpm pkg-pr-new publish './packages/*' './packages/sdk-effects/*' --packageManager=pnpm --comment=off + run: pnpm pkg-pr-new publish './packages/*' './packages/sdk-effects/*' --packageManager=pnpm --comment=off + env: + GITHUB_TOKEN: ${{ inputs.token || env.GITHUB_TOKEN }}Optionally confirm the caller workflow sets:
- job permissions: contents: write, pull-requests: write
- env: GITHUB_TOKEN provided by GitHub
12-17: Pin action to a commit SHA and set target branch explicitlyFor supply‑chain safety, pin
JamesIves/github-pages-deploy-actionto a commit SHA. Also setbranchexplicitly (usuallygh-pages) to avoid environment drift.- - name: Publish api docs [beta] - uses: JamesIves/[email protected] + - name: Publish api docs [beta] + uses: JamesIves/github-pages-deploy-action@9dc5b8d3b75f3cc1b1b5a7eaa63a6a5c9e1d2b48 # v4.7.3 with: - folder: docs + branch: gh-pages + folder: docs commit-message: 'chore: release-api-docs-beta' target-folder: 'beta'Also ensure the caller job has
pages: writeorcontents: writepermissions as required by the action and thatdocs/is built before invoking this step..github/actions/setup/action.yml (3)
22-26: Pin third‑party actions to commit SHAsPin all marketplace actions to immutable SHAs (checkout, pnpm/action-setup, setup-node, actions/cache, nrwl/nx-set-shas, upload-artifact) to reduce supply‑chain risk.
Example:
- actions/checkout@v4 → actions/checkout@b4ffde6
- pnpm/action-setup@v4 → pnpm/action-setup@
- actions/setup-node@v4 → actions/setup-node@
- actions/cache@v4 → actions/cache@
- nrwl/nx-set-shas@v4 → nrwl/nx-set-shas@
- actions/upload-artifact@v4 → actions/upload-artifact@
Also applies to: 27-29, 31-36, 56-62, 67-67, 73-80
37-39: Updating npm globally may be unnecessary and adds timeUnless you hit a specific npm bug, consider omitting
npm install -g npm@latestto speed up CI and keep npm aligned with the selected Node version.
63-66: Playwright install nuancesIf using GitHub-hosted runners, browsers are often preinstalled/restored via cache; consider skipping install for non-e2e jobs, or gate with a boolean input to reduce time. Use
--with-depsonly when needed on self-hosted Linux.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/actions/publish-beta/action.yml(1 hunks).github/actions/publish-release/action.yml(1 hunks).github/actions/setup/action.yml(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/actions/publish-release/action.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version-file: ${{ inputs.node-version-file }} | ||
| cache: 'pnpm' | ||
| registry-url: 'https://registry.npmjs.org' | ||
|
|
||
| - name: Update npm | ||
| run: npm install -g npm@latest | ||
| shell: bash | ||
|
|
||
| - name: Setup pnpm config | ||
| run: pnpm config set store-dir ${{ inputs.pnpm-cache-folder }} --global | ||
| shell: bash | ||
|
|
||
| - name: Install dependencies | ||
| run: pnpm install --frozen-lockfile |
There was a problem hiding this comment.
Fix pnpm cache miss: configure store before setup-node caching
actions/setup-node@v4 with cache: 'pnpm' determines the store path before your pnpm config set store-dir … runs, so the restored cache won’t match the configured store. Move the pnpm config step above setup-node.
- uses: pnpm/action-setup@v4
with:
run_install: false
- - uses: actions/setup-node@v4
- with:
- node-version-file: ${{ inputs.node-version-file }}
- cache: 'pnpm'
- registry-url: 'https://registry.npmjs.org'
-
- - name: Update npm
- run: npm install -g npm@latest
- shell: bash
-
- - name: Setup pnpm config
+ - name: Setup pnpm config (global)
run: pnpm config set store-dir ${{ inputs.pnpm-cache-folder }} --global
shell: bash
+
+ - uses: actions/setup-node@v4
+ with:
+ node-version-file: ${{ inputs.node-version-file }}
+ cache: 'pnpm'
+ registry-url: 'https://registry.npmjs.org'
+
+ - name: Update npm
+ run: npm install -g npm@latest
+ shell: bash📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: ${{ inputs.node-version-file }} | |
| cache: 'pnpm' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Update npm | |
| run: npm install -g npm@latest | |
| shell: bash | |
| - name: Setup pnpm config | |
| run: pnpm config set store-dir ${{ inputs.pnpm-cache-folder }} --global | |
| shell: bash | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| run_install: false | |
| - name: Setup pnpm config (global) | |
| run: pnpm config set store-dir ${{ inputs.pnpm-cache-folder }} --global | |
| shell: bash | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: ${{ inputs.node-version-file }} | |
| cache: 'pnpm' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Update npm | |
| run: npm install -g npm@latest | |
| shell: bash | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile |
🤖 Prompt for AI Agents
In .github/actions/setup/action.yml around lines 31 to 46, the pnpm store-dir is
configured after actions/setup-node evaluates its pnpm cache key, causing cache
misses; move the "Setup pnpm config" step (pnpm config set store-dir ${{
inputs.pnpm-cache-folder }} --global) to run before the actions/setup-node@v4
step (so the cache key is computed against the configured store path), keep the
setup-node step with cache: 'pnpm' afterwards, and ensure subsequent steps
(Update npm, Install dependencies) remain in correct order.
| - name: Nx Cloud start | ||
| run: pnpm dlx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yml" --stop-agents-after="e2e-ci" --with-env-vars="CODECOV_TOKEN" | ||
| shell: bash | ||
| env: | ||
| CODECOV_TOKEN: ${{ env.CODECOV_TOKEN }} | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
Verify Nx Cloud distribution file and env var presence
Ensure .nx/workflows/dynamic-changesets.yml exists and CODECOV_TOKEN is available (optional) in the caller job env; otherwise the start-ci-run could fail or run suboptimally.
🏁 Script executed:
#!/bin/bash
# Verify Nx distribution config file and docs presence used elsewhere
set -euo pipefail
echo "Nx distribution file:"
fd dynamic-changesets.yml -H -a | sed -n '1,5p'
echo "Codecov token env set? (expect non-empty or intentionally unset)"
test -n "${CODECOV_TOKEN:-}" && echo "CODECOV_TOKEN is set" || echo "CODECOV_TOKEN not set"Length of output: 164
Add CODECOV_TOKEN or remove it from --with-env-vars
.nx/workflows/dynamic-changesets.yml exists, but CODECOV_TOKEN isn’t set in this job—add it to the workflow env or drop it from the --with-env-vars flag to avoid passing an empty value.
🤖 Prompt for AI Agents
.github/actions/setup/action.yml lines 49-54: The Nx Cloud start step includes
--with-env-vars="CODECOV_TOKEN" but CODECOV_TOKEN is not provided in this job;
either add CODECOV_TOKEN to the job's environment or remove it from the
--with-env-vars flag so an empty value isn't passed. Update the workflow by (A)
adding CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} or similar to the env block
for this job, or (B) deleting CODECOV_TOKEN from the --with-env-vars argument if
codecov is not needed here.
JIRA Ticket
N/A
Description
bad interpolation fix in 2ba62e4
the other two commits are me refactoring the workflows to use composite actions. I felt they were getting unmaintainbly long. just wanted to make it easier to parse through.
We can hold off on merging these until i'm back if preferred, they look like they all work fine but i'd hate for them not to and someone have to debug and fix it.
@spetrov maybe can review
Summary by CodeRabbit