chore: fix-slackbot #427
chore: fix-slackbot #427
Conversation
|
WalkthroughReplaces inline CI setup, caching, and publish steps with three local composite GitHub Actions: Changes
Sequence Diagram(s)sequenceDiagram
participant Workflow as publish.yml
participant Setup as .github/actions/setup
participant PublishRelease as .github/actions/publish-release
participant PublishBeta as .github/actions/publish-beta
participant Slack as slackapi/slack-github-action
participant Pages as github-pages-deploy-action
rect rgb(245,250,255)
Workflow->>Setup: call "Setup Project" (inputs: token, pnpm-cache-folder, node-version-file)
Setup-->>Workflow: setup complete
end
alt release path (published == true)
Workflow->>PublishRelease: call "Publish Release Steps" (publishedPackages, slackWebhook)
PublishRelease->>PublishRelease: format publishedPackages -> GitHub output
PublishRelease->>Slack: post formatted payload (webhook)
PublishRelease->>Pages: deploy api docs (chore: release-api-docs)
PublishRelease-->>Workflow: release done
else beta path
Workflow->>PublishBeta: call "Publish Beta Steps"
PublishBeta->>PublishBeta: run pnpm PR publish command (create PR)
PublishBeta->>Pages: deploy beta docs (beta commit message)
PublishBeta-->>Workflow: beta done
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
View your CI Pipeline Execution ↗ for commit b4a3a82
☁️ Nx Cloud last updated this comment at |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/publish.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (18.75%) is below the target coverage (40.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #427 +/- ##
=======================================
Coverage 18.75% 18.75%
=======================================
Files 138 138
Lines 27368 27368
Branches 951 951
=======================================
Hits 5132 5132
Misses 22236 22236 🚀 New features to boost your workflow:
|
@forgerock/davinci-client
@forgerock/oidc-client
@forgerock/protect
@forgerock/sdk-types
@forgerock/sdk-utilities
@forgerock/iframe-manager
@forgerock/sdk-logger
@forgerock/sdk-oidc
@forgerock/sdk-request-middleware
@forgerock/storage
commit: |
|
Deployed e0cab0c to https://ForgeRock.github.io/ping-javascript-sdk/pr-427/e0cab0c7f97ced3abfc7073f691879eabf5eb944 branch gh-pages in ForgeRock/ping-javascript-sdk |
📦 Bundle Size Analysis📦 Bundle Size Analysis🚨 Significant Changes🔻 @forgerock/journey-client - 0.0 KB (-82.0 KB, -100.0%) 📊 Minor Changes📈 @forgerock/journey-client - 82.0 KB (+0.0 KB) ➖ No Changes➖ @forgerock/device-client - 9.2 KB 13 packages analyzed • Baseline from latest Legend🆕 New package ℹ️ How bundle sizes are calculated
🔄 Updated automatically on each push to this PR |
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/actions/publish-beta/action.yml (1)
4-7: Remove the deadbranchinput (or actually use it).The action exposes a
branchinput but never consumes it, so callers pass data that’s silently ignored. Please either wire the input into the action logic or drop it from the interface.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/actions/publish-beta/action.yml(1 hunks).github/actions/publish-release/action.yml(1 hunks).github/actions/setup/action.yml(1 hunks).github/workflows/publish.yml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
| { | ||
| "publishedPackages": "${{ steps.slackify.outputs.message }}" | ||
| } |
There was a problem hiding this comment.
Slack payload missing required text (webhook rejects it).
Incoming webhooks expect a text or blocks field; sending { "publishedPackages": "…" } results in invalid_payload, so the notification never lands. Wrap the formatted string under text (or build a proper block) before calling the Slack action.
🤖 Prompt for AI Agents
In .github/actions/publish-release/action.yml around lines 27 to 29, the JSON
payload currently sends { "publishedPackages": "${{
steps.slackify.outputs.message }}" } which Slack incoming webhooks reject
because they require a top-level text or blocks field; replace the payload so it
wraps the message under a "text" key (or construct a "blocks" array) e.g. set
the payload to { "text": "${{ steps.slackify.outputs.message }}" } and ensure
any escaping/quoting matches the YAML/step input format.
There was a problem hiding this comment.
are you sure? this is a slack workflow builder setup
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Slack Workflow Builder webhook custom variables payload
💡 Result:
Short answer
- Workflow Builder webhook expects a JSON (HTTP POST) body with top-level string key→value pairs for custom variables (no nested objects/arrays). Up to 20 custom variables may be defined (types: text, channel ID, user ID, user email). Nested payloads must be flattened/stringified before sending. [1][2][3]
Example (POST application/json)
{
"alert_title": "Database outage",
"severity": "critical",
"channel_id": "C01234567",
"owner_email": "[email protected]"
}
Notes
- The webhook URL is generated by Workflow Builder and looks like https://hooks.slack.com/workflows/.... Use that URL as the POST target. [1][2]
- If you have nested JSON, flatten or stringify keys (tools/approach examples: Slack’s guidance and community tools that flatten JSON). Many integrations (and slackapi’s GitHub Action) flatten payloads using a delimiter. [2][3]
- Webhook workflows are limited to ~1 request/sec; missing expected variables will cause an error. [1]
Sources
[1] Slack Help: Build a workflow — Create a workflow that starts outside of Slack.
[2] Slack Developer Docs: Sending data via a webhook to start a Slack workflow (and slackapi slack-github-action docs).
[3] “Flatten JSON for Workflow Builder” (guidance + community tooling).
@ryanbas21 You're absolutely right—I apologize for the confusion!
Since you're using webhook-type: webhook-trigger, this is indeed a Slack Workflow Builder webhook, not a standard incoming webhook. Workflow Builder webhooks accept custom variables as top-level key-value pairs (like "publishedPackages"), and they don't require the text or blocks fields that standard incoming webhooks do.
Your payload structure is correct for a Workflow Builder setup:
payload: >
{
"publishedPackages": "${{ steps.slackify.outputs.message }}"
}The custom variable publishedPackages should map to whatever variable name you've configured in your Workflow Builder workflow. My earlier comment was based on standard incoming webhook requirements, which don't apply here. Thank you for catching that! 👍
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Setup Project |
There was a problem hiding this comment.
There should be nothing different, i just refactored this to be more "clean" and use a composite action that can be reused across steps.
| env: | ||
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | ||
|
|
||
| - run: git status |
There was a problem hiding this comment.
removed this b/c unneccessary
| - name: Publish Release Steps | ||
| if: steps.changesets.outputs.published == 'true' | ||
| uses: slackapi/[email protected] | ||
| with: | ||
| payload-delimiter: '_' | ||
| webhook: ${{ secrets.SLACK_WEBHOOK_URL }} | ||
| webhook-type: webhook-trigger | ||
| payload: steps.changesets.outputs.publishedPackages | ||
|
|
||
| - uses: codecov/codecov-action@v5 | ||
| uses: ./.github/actions/publish-release | ||
| with: | ||
| files: ./packages/**/coverage/*.xml | ||
| token: ${{ secrets.CODECOV_TOKEN }} | ||
|
|
||
| - name: Ensure builds run | ||
| run: pnpm nx run-many -t build | ||
| env: | ||
| NX_CLOUD_DISTRIBUTED_EXECUTION: false | ||
| publishedPackages: ${{ steps.changesets.outputs.publishedPackages }} | ||
| slackWebhook: ${{ secrets.SLACK_WEBHOOK_URL }} |
There was a problem hiding this comment.
Broke this branching out into reusable composite actions
just to clean up this workflow
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/actions/setup/action.yml(1 hunks).github/workflows/publish.yml(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (6)
.github/actions/publish-beta/action.yml (3)
3-7: Remove emptyinputsblock or define real inputsAn empty
inputs:is noise. Either remove it or add explicit inputs (e.g.,token,docs-folder,branch) you plan to consume.
8-11: Ensure auth for PR creation (GITHUB_TOKEN) is wired
pnpm pkg-pr-new publish …will need a token to open PRs. Composite actions don’t auto-inject inputs; rely onGITHUB_TOKENfrom the caller job and ensurepermissions: contents: write, pull-requests: writeare set, or accept atokeninput and pass it as env.Example adjustment within this action:
inputs: + token: + description: 'GitHub token with contents & pull-requests write' + required: false steps: - name: Create PR for beta publish shell: bash - run: pnpm pkg-pr-new publish './packages/*' './packages/sdk-effects/*' --packageManager=pnpm --comment=off + run: pnpm pkg-pr-new publish './packages/*' './packages/sdk-effects/*' --packageManager=pnpm --comment=off + env: + GITHUB_TOKEN: ${{ inputs.token || env.GITHUB_TOKEN }}Optionally confirm the caller workflow sets:
- job permissions: contents: write, pull-requests: write
- env: GITHUB_TOKEN provided by GitHub
12-17: Pin action to a commit SHA and set target branch explicitlyFor supply‑chain safety, pin
JamesIves/github-pages-deploy-actionto a commit SHA. Also setbranchexplicitly (usuallygh-pages) to avoid environment drift.- - name: Publish api docs [beta] - uses: JamesIves/[email protected] + - name: Publish api docs [beta] + uses: JamesIves/github-pages-deploy-action@9dc5b8d3b75f3cc1b1b5a7eaa63a6a5c9e1d2b48 # v4.7.3 with: - folder: docs + branch: gh-pages + folder: docs commit-message: 'chore: release-api-docs-beta' target-folder: 'beta'Also ensure the caller job has
pages: writeorcontents: writepermissions as required by the action and thatdocs/is built before invoking this step..github/actions/setup/action.yml (3)
22-26: Pin third‑party actions to commit SHAsPin all marketplace actions to immutable SHAs (checkout, pnpm/action-setup, setup-node, actions/cache, nrwl/nx-set-shas, upload-artifact) to reduce supply‑chain risk.
Example:
- actions/checkout@v4 → actions/checkout@b4ffde6
- pnpm/action-setup@v4 → pnpm/action-setup@
- actions/setup-node@v4 → actions/setup-node@
- actions/cache@v4 → actions/cache@
- nrwl/nx-set-shas@v4 → nrwl/nx-set-shas@
- actions/upload-artifact@v4 → actions/upload-artifact@
Also applies to: 27-29, 31-36, 56-62, 67-67, 73-80
37-39: Updating npm globally may be unnecessary and adds timeUnless you hit a specific npm bug, consider omitting
npm install -g npm@latestto speed up CI and keep npm aligned with the selected Node version.
63-66: Playwright install nuancesIf using GitHub-hosted runners, browsers are often preinstalled/restored via cache; consider skipping install for non-e2e jobs, or gate with a boolean input to reduce time. Use
--with-depsonly when needed on self-hosted Linux.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/actions/publish-beta/action.yml(1 hunks).github/actions/publish-release/action.yml(1 hunks).github/actions/setup/action.yml(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/actions/publish-release/action.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
Moves the "Setup pnpm config" step to before node setup for better ordering. Updates the CODECOV_TOKEN to use `secrets.CODECOV_TOKEN` instead of `env.CODECOV_TOKEN`. This improves security in the CI workflow.
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This adds a new GitHub Actions workflow that runs on pull requests from forks. This workflow is designed to be secure by not using any secrets. It runs linting, building, and testing on the affected projects.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/ci-fork.yml (1)
1-45: ci-fork.yml is missing critical setup steps from the new Setup Project composite action.The workflow cannot directly use the composite action due to fork-specific requirements (head SHA checkout, git branch tracking for nx affected, custom nx tasks), but it is missing important setup optimizations present in
.github/actions/setup/action.yml:
- Nx Cloud initialization (
pnpm dlx nx-cloud start-ci-run...) — required for distributed testing and CI metrics- pnpm store-dir config — improves cache efficiency
- npm registry-url setup — ensures correct npm resolution
- npm upgrade to latest — maintains tool currency
- Playwright report artifact upload — enables debugging of failed e2e tests
The different
nx affectedtask list (ci-fork includestypecheckandformat:checkseparately) is appropriate for fork PRs, but the foundational setup gaps should be addressed.Consider backfilling these setup steps into ci-fork.yml or creating a fork-specific composite action that wraps the core setup with fork requirements.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/ci-fork.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
Nx Cloud has identified a possible root cause for your failed CI:
The PR makes changes exclusively to GitHub Actions workflow files and composite action definitions. The changes refactor CI/CD pipeline configuration by extracting repeated setup and publish steps into reusable composite actions.
The failing task is @forgerock/davinci-suites:e2e-ci--src/protect.test.ts, which runs Playwright end-to-end tests for the DaVinci Protect functionality. Two tests are failing:
- "Test Protect collector with Custom HTML component" - fails at line 42
- "Test Protect collector with P1 Forms component" - fails at line 79
Both tests fail because the expected text (indicating a bot was blocked by PingOne Risk protection) is not appearing on the page within the 5-second timeout. The tests are looking for specific text patterns that should appear when risk-based protection blocks access.
Classification: flaky_task
This is classified as a flaky test for the following reasons:
- The PR diff contains zero changes to application code, test code, or any code that would affect the behavior of the Protect collector functionality
- All changes are limited to GitHub Actions workflow YAML files (.github/actions/ and .github/workflows/)
- The failing tests are integration/e2e tests that depend on external services (PingOne Risk protection service)
- The test failures involve timing issues (5-second timeout waiting for text to appear)
- There is no causal relationship between refactoring CI/CD workflow configuration and the runtime behavior of the Protect risk evaluation system
The failures are likely due to:
- Network latency or connectivity issues with the PingOne Risk service
- The external risk service being temporarily unavailable or slow to respond
- Environmental conditions affecting the e2e test execution environment
- Timing-sensitive race conditions in the test environment
Since the PR changes only affect how CI/CD pipelines are structured and do not modify any application logic, test logic, or dependencies, these test failures are environmentally induced and unrelated to the code changes.
A code change would likely not resolve this issue, so no action was taken.
🎓 To learn more about Self Healing CI, please visit nx.dev
2 participants
JIRA Ticket
N/A
Description
bad interpolation fix in 2ba62e4
the other two commits are me refactoring the workflows to use composite actions. I felt they were getting unmaintainbly long. just wanted to make it easier to parse through.
We can hold off on merging these until i'm back if preferred, they look like they all work fine but i'd hate for them not to and someone have to debug and fix it.
@spetrov maybe can review
Summary by CodeRabbit