Skip to content

Users/jon.tiritilli/auto id pr#13

Merged
jontiritilli merged 19 commits into
mainfrom
users/jon.tiritilli/auto-id-pr
Jun 8, 2026
Merged

Users/jon.tiritilli/auto id pr#13
jontiritilli merged 19 commits into
mainfrom
users/jon.tiritilli/auto-id-pr

Conversation

@jontiritilli

Copy link
Copy Markdown
Contributor

No description provided.

jontiritilli and others added 19 commits June 8, 2026 08:29
When ryuu creates a new design, capture the designId from stdout,
write it back to the source manifest.json, and commit it via
github-token (optional). Falls back to Job Summary + warning
annotation if no token is provided so the id is never lost.

- publishApp now uses getExecOutput to capture ryuu stdout
- findSourceManifest searches manifest.json → public/ → src/
- commitManifestId uses http.extraheader (no token in remote URL)
- New github-token input and design-id output in action.yml
- 17 new tests covering all code paths; fixed 2 broken existing tests
- Docs: action-pipeline.md, first-time-setup.md, cicd-user-setup.md
- README: updated inputs/outputs tables, examples, and naming
  consistency (DOMO_TOKEN / DOMO_INSTANCE throughout)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
… env arg

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
5.0.4 (npm latest) has a bug that causes 'Error when creating new design'
with an empty message. 5.1.0-beta.1 (npm beta tag) fixes it. Pin to
@beta until a stable 5.1.x is published.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Install via official install.sh instead of npm install -g ryuu
- Auth: domo auth login <instance> --token instead of domo login -i -t
- Publish: domo app publish --build-dir --go instead of domo publish
- Remove chdir-to-publishDir step; --build-dir handles path resolution
- Broader new-design detection covers both old and new CLI output formats

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
--go opens the design in a browser (not a CI skip-confirm flag).
Using a named profile ensures domo auth login and domo app publish
use the same credentials with no ambiguity about the active profile.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Single login per CI run means the active profile is unambiguous.
--profile was unnecessary complexity.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- domo auth whoami after login confirms the correct identity in CI logs
- New CLI outputs 'Created design {id}' not 'New design created'
- Update regex to match 'Created design ([uuid])' from new CLI output

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
On first publish, creates branch chore/add-domo-design-id, writes
the id to the source manifest (public/manifest.json or manifest.json),
and opens a PR against main via the GitHub API. Requires
permissions: contents: write + pull-requests: write.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
chore/add-domo-design-id clashes on re-runs if the branch already
exists on the remote. Using chore/domo-design-id-{8chars} makes
each first-publish branch unique.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
git checkout/add/commit/push was fragile in CI (extraheader setup,
branch conflicts, no-TTY). Pure octokit API calls are more reliable:
- getRef to get main SHA
- createRef to create the branch
- getContent + createOrUpdateFileContents to commit the manifest
- pulls.create to open the PR
No git CLI involvement.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- CLAUDE.md: replace ryuu with new CLI, document PR flow
- action-pipeline.md: new CLI commands, API-based PR creation
- first-time-setup.md: PR merge replaces manual copy-paste
- cicd-user-setup.md: shorter, two real workflow examples (ProCode + pnpm/React)
- README: features, quick start, how it works, pnpm example updated

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Fix contradictory build:ci note (da apply-manifest WITH env arg is fine in CI)
- Standardize pnpm version comment to 'match your project'
- Replace hardcoded domo instance URLs in multi-env example
- Remove ryuu references from migration section and support links
- Add Domo CLI link to support section

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Remove ryuu (no longer used, was source of 11 high/medium vulns)
- Add undici override >=6.21.1 to fix transitive vuln via @actions/github
- Upgrade @actions/github to ^6.0.1 (latest CJS-compatible version)
- Result: 0 vulnerabilities

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- CI was using yarn --frozen-lockfile but only package-lock.json exists
- npm overrides (for undici) don't work in yarn; yarn uses resolutions
- This caused dist/index.js to differ between local npm build and CI yarn build
- Also update CLAUDE.md to reflect npm everywhere

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- validateInputs: use URL.hostname.endsWith('.domo.com') instead of
  .includes() to prevent subdomain spoofing (js/incomplete-url-substring-sanitization)
- test.yml: add permissions: contents: read (actions/missing-workflow-permissions)
- Add spoof test case and bare-hostname test to cover new validation logic

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Go CLI accepts .domo.com, domorig.io, and domotech.io domains.
Our validator was only checking .domo.com.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@jontiritilli jontiritilli merged commit 0c704e6 into main Jun 8, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant