chore: promote next to production (2025-10-29) - #127
Merged
Conversation
- Updated README.md to recommend sonnet-4.5 as the preferred model for new agents. - Changed model references in commit-message-generator.md and pr-creator.md to sonnet-4.5. - Modified schema.d.ts and schema.json to include sonnet-4.5 as an option for agent models.
- Updated README.md to recommend sonnet-4.5 as the preferred model for new agents. - Changed model references in commit-message-generator.md and pr-creator.md to sonnet-4.5. - Modified schema.d.ts and schema.json to include sonnet-4.5 as an option for agent models.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.0 - project: @ai-toolkit/utils 0.2.10-next.0 - project: @ai-toolkit/agents-agnostic 0.2.10-next.0 - project: @ai-toolkit/commands-agnostic 0.1.14-next.0 - project: @ai-toolkit/commands-typescript 0.1.11-next.0
- Updated README.md to recommend sonnet-4.5 as the preferred model for new agents. - Changed model references in commit-message-generator.md and pr-creator.md to sonnet-4.5. - Modified schema.d.ts and schema.json to include sonnet-4.5 as an option for agent models.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.1 - project: @ai-toolkit/utils 0.2.10-next.1 - project: @ai-toolkit/agents-agnostic 0.2.10-next.1 - project: @ai-toolkit/commands-agnostic 0.1.14-next.1 - project: @ai-toolkit/commands-typescript 0.1.11-next.1
#73) * Improve the claude docs agents by adding a fact-checker subagent that verifies the output of other claude doc agents Completes DEV-107 sub-commits: add initial plan implement plan for updating claude-docs to use fact-checker and batched approvals * add model prompt parameter to several subagents
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.2 - project: @ai-toolkit/utils 0.2.10-next.2 - project: @ai-toolkit/agents-agnostic 0.2.10-next.2 - project: @ai-toolkit/commands-agnostic 0.1.14-next.2 - project: @ai-toolkit/commands-typescript 0.1.11-next.2
…mation for git commits at logical completion points (#72) * improvement: update execute-plan documentation to require user confirmation for git commits at logical completion points * improvement: require user confirmation before creating git commits in various workflows
…timize deployment process (#75) ### TL;DR Added an ignore command to the Vercel configuration for the Slack OAuth backend to skip deployments when the project is not affected. ### What changed? Added an `ignoreCommand` to the `vercel.json` file that uses the Nx affected projects detection to determine if the `slack-oauth-backend` project was modified between the previous and current commit. If the project wasn't affected, the deployment will be skipped. ### How to test? 1. Make a change to a different project in the monorepo 2. Verify that the Slack OAuth backend doesn't deploy on Vercel 3. Make a change to the Slack OAuth backend 4. Verify that the deployment proceeds as expected ### Why make this change? This optimization prevents unnecessary deployments of the Slack OAuth backend when changes are made to unrelated parts of the codebase. This will save deployment resources and time by only triggering deployments when the project is actually affected by changes.
… Slack notifications (#76) ### Summary of Changes - Updated the production update workflow to generate a categorized changelog based on commit types (features, fixes, documentation, maintenance, and others). - Added Slack notifications for both successful PR creation and merge conflicts. - Improved workflow documentation to clarify required secrets and behavior. - Assigned specific reviewers to the PR and included detailed next steps in the summary. ### Why This Change? These enhancements streamline the release process, improve communication with the team, and ensure that the changelog is informative and well-structured for easier review.
### Summary of Changes - Replaced single quotes with double quotes for consistency in the `publish-packages.yml` file. - Removed the NPM authentication verification step that was conditional on the dry run input. ### Why This Change? These adjustments improve the readability of the workflow file and streamline the publishing process by eliminating unnecessary checks.
…78) ### Summary of Changes - Deleted `always-auth` and `_authToken` entries from `.npmrc`. - Removed `NODE_AUTH_TOKEN` references from the GitHub Actions workflow and documentation. ### Why This Change? These modifications streamline the configuration by eliminating unnecessary authentication steps, enhancing clarity and security in the publishing process.
…ion flow (#71) * feat: enhance addon installation process and conditional prompting - Added support for installing all MCP servers at once or a specific one via new `installMode` option. - Updated generator logic to handle installation modes and provide detailed installation summaries. - Introduced critical rules for conditional prompting in Nx generator schemas to improve user experience. - Expanded addon registry with new MCP servers including Graphite, Nx, Slack, and others. - Enhanced documentation for MCP authentication instructions and setup guidance. * get notion mcp addon working This required changing the AddonMetadata interface to support a new non-command based way of adding mcps to claude --------- Co-authored-by: Melvillian <alex.melville@uniswap.org>
### TL;DR Updated MCP configuration for Figma and Vercel addons to use the new transport/url pattern. ### What changed? Modified the addon registry configuration for Figma and Vercel addons: - Renamed `command` to `transport` in both addon configurations - Renamed `args` array to `url` string property - Preserved the actual transport types and URLs ### How to test? 1. Verify that the Figma addon connects properly using SSE transport to `http://127.0.0.1:3845/mcp` 2. Verify that the Vercel addon connects properly using HTTP transport to `https://mcp.vercel.com` ### Why make this change? This change standardizes the MCP configuration pattern by using more descriptive property names (`transport` instead of `command`, `url` instead of an array of arguments). This improves code readability and makes the configuration more intuitive while maintaining the same functionality.
- Removed Bun-related configurations and commands throughout the project. - Updated all instances of `bunx` to `npx` in scripts, documentation, and configuration files. - Deleted `bun.lock` and `bun.lockb` files, replacing them with `package-lock.json`. - Adjusted CI/CD workflows to utilize npm commands for dependency installation and package management. - Enhanced documentation to reflect the changes in package management and installation processes. This transition aims to streamline the development workflow and improve compatibility across environments.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.3 - project: @ai-toolkit/utils 0.2.10-next.3 - project: @ai-toolkit/agents-agnostic 0.2.10-next.3 - project: @ai-toolkit/commands-agnostic 0.1.14-next.3 - project: @ai-toolkit/commands-typescript 0.1.11-next.3
#79) ### Summary of Changes - Introduced a new command `daily-standup` that checks assigned Linear tasks and generates a team update. - Documented the workflow process, execution steps, usage examples, and output format in `daily-standup.md`. - Updated `index.ts` to include the new command with a brief description. ### Why This Change? This addition enhances team communication by providing a structured update on ongoing tasks and recent GitHub activity, facilitating better collaboration during daily standups.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.4 - project: @ai-toolkit/utils 0.2.10-next.4 - project: @ai-toolkit/agents-agnostic 0.2.10-next.4 - project: @ai-toolkit/commands-agnostic 0.1.14-next.4 - project: @ai-toolkit/commands-typescript 0.1.11-next.4
- Implemented a new step in the GitHub Actions workflow to send a Slack notification when packages are published from the `next` branch. - The notification includes details about the published packages, the commit SHA, and a link to the workflow run. - This enhancement aims to improve communication and visibility for team members regarding package releases.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.5 - project: @ai-toolkit/utils 0.2.10-next.5 - project: @ai-toolkit/agents-agnostic 0.2.10-next.5 - project: @ai-toolkit/commands-agnostic 0.1.14-next.5 - project: @ai-toolkit/commands-typescript 0.1.11-next.5
…#89) - Updated the Slack notification step in the GitHub Actions workflow to build the JSON payload in a temporary file, enhancing readability and maintainability. - Added error handling for the Slack notification to ensure the workflow continues even if the notification fails. - Escaped package names in the notification to prevent JSON formatting issues. - Improved debugging output by displaying the HTTP status and response from the Slack API.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.6 - project: @ai-toolkit/utils 0.2.10-next.6 - project: @ai-toolkit/agents-agnostic 0.2.10-next.6 - project: @ai-toolkit/commands-agnostic 0.1.14-next.6 - project: @ai-toolkit/commands-typescript 0.1.11-next.6
* chore(ci): Add pre checks * Fix * chore: regenerate package-lock.json with Node.js 22.21.0 - Regenerated lockfile using Node.js v22.21.0 (npm 10.9.4) to match CI environment - Fixes dependency resolution and hoisting differences - Ensures CI package-lock.json validation check passes * Align node versions * base branch fix
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.7 - project: @ai-toolkit/utils 0.2.10-next.7 - project: @ai-toolkit/agents-agnostic 0.2.10-next.7 - project: @ai-toolkit/commands-agnostic 0.1.14-next.7 - project: @ai-toolkit/commands-typescript 0.1.11-next.7
#90) - Updated the CLI generator to provide a clearer distinction between external and internal usage. - External users now default to the init generator when no arguments are provided, while internal users can access an interactive menu for all generators. - Enhanced documentation within the code to clarify usage scenarios and improve developer experience.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.8 - project: @ai-toolkit/utils 0.2.10-next.8 - project: @ai-toolkit/agents-agnostic 0.2.10-next.8 - project: @ai-toolkit/commands-agnostic 0.1.14-next.8 - project: @ai-toolkit/commands-typescript 0.1.11-next.8
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.4 - project: @ai-toolkit/utils 0.2.10-next.4 - project: @ai-toolkit/agents-agnostic 0.2.10-next.4 - project: @ai-toolkit/commands-agnostic 0.1.14-next.4 - project: @ai-toolkit/commands-typescript 0.1.11-next.4
- Implemented a new step in the GitHub Actions workflow to send a Slack notification when packages are published from the `next` branch. - The notification includes details about the published packages, the commit SHA, and a link to the workflow run. - This enhancement aims to improve communication and visibility for team members regarding package releases.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.5 - project: @ai-toolkit/utils 0.2.10-next.5 - project: @ai-toolkit/agents-agnostic 0.2.10-next.5 - project: @ai-toolkit/commands-agnostic 0.1.14-next.5 - project: @ai-toolkit/commands-typescript 0.1.11-next.5
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.6 - project: @ai-toolkit/utils 0.2.10-next.6 - project: @ai-toolkit/agents-agnostic 0.2.10-next.6 - project: @ai-toolkit/commands-agnostic 0.1.14-next.6 - project: @ai-toolkit/commands-typescript 0.1.11-next.6
* chore(ci): Add pre checks * Fix * chore: regenerate package-lock.json with Node.js 22.21.0 - Regenerated lockfile using Node.js v22.21.0 (npm 10.9.4) to match CI environment - Fixes dependency resolution and hoisting differences - Ensures CI package-lock.json validation check passes * Align node versions * base branch fix
…ation (#93) - Refactored the GitHub Actions workflow to enhance the changelog generation process. - Changed the handling of the dry run input description and default values to use consistent quotation marks. - Updated the logic to retrieve git diffs and commit messages for better context in changelog generation. - Implemented a fallback mechanism to generate a changelog from commits if AI generation fails. - Improved Slack notification formatting to include commit range and package details.
- Updated the GitHub Actions workflow to build only changed packages instead of all packages. - Enhanced the changelog generation prompt to specify formatting requirements for Slack, including bullet points and text styling.
chore(workflow): refine build process and changelog prompt - Updated the GitHub Actions workflow to build only changed packages instead of all packages. - Enhanced the changelog generation prompt to specify formatting requirements for Slack, including bullet points and text styling. chore(nx.json): add custom commit message for releases - Introduced a custom commit message format for releases to streamline the publishing process.
…cy management (#96) - Updated nx.json to simplify versioning configuration by removing redundant git settings and enhancing the commit message format for releases. - Modified package-lock.json to replace 'dev' with 'devOptional' for several dependencies, improving clarity on optional development dependencies.
- Reintroduced git settings for commit and tag options within the versioning and changelog sections of nx.json to ensure proper handling during releases.
…hangelog generation (#99)
#124) - Implemented auto-merge functionality for production release PRs if no merge conflicts are detected. - Updated Slack notifications to reflect the auto-merge status and adjusted summary messages accordingly. - Refined changelog generation and reviewer assignment logic to improve clarity and user experience.
…tions (#126) - Updated the changelog generation summary to use heredoc for safer content handling. - Improved prompt source determination logic for better clarity in the summary. - Streamlined the output format for the generated changelog, ensuring consistent presentation.
- Deleted the notify-release GitHub Actions workflow as it is no longer needed. - This workflow was responsible for generating changelogs and sending notifications to Slack upon releases.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![semgrep-code-uniswap[bot]](https://avatars.githubusercontent.com/u/36115574?s=60&v=4){kind=small}
| scope: "@uniswap" | ||
|
|
||
| - name: Install npm | ||
| run: npm install -g npm@10.9.2 |
There was a problem hiding this comment.
$...LIB
An npm script inside an action on GitHub is not pinned to a full length commit SHA. Pinning the npm package to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
⭐ Removed in commit 4a32a90 ⭐
| fetch-depth: 0 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
First step in each job must use bullfrogsec/bullfrog, unless the job is on macOS.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by gh-actions-first-step-must-be-bullfrogsec.
You can view more details about this finding in the Semgrep AppSec Platform.
| - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4 | ||
|
|
||
| - name: Checkout repository | ||
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
First step in each job must use bullfrogsec/bullfrog, unless the job is on macOS.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by gh-actions-first-step-must-be-bullfrogsec.
You can view more details about this finding in the Semgrep AppSec Platform.
Comment on lines
221
to
+248
| run: | | ||
| echo "## 📝 Changelog Generation Summary" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Commit Range**: \`${{ inputs.before_sha }}\` → \`${{ inputs.after_sha }}\`" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Generation Method**: ${{ steps.ai-changelog.outcome == 'success' && 'AI-powered ✨' || 'Fallback (commit list) ⚠️' }}" >> $GITHUB_STEP_SUMMARY | ||
| # Safely capture the changelog using heredoc | ||
| CHANGELOG=$(cat <<'CHANGELOG_EOF' | ||
| ${{ steps.ai-changelog.outputs.changelog || steps.fallback-changelog.outputs.changelog }} | ||
| CHANGELOG_EOF | ||
| ) | ||
|
|
||
| # Determine prompt source | ||
| if [ -n "${{ inputs.custom_prompt_text }}" ]; then | ||
| echo "- **Prompt Source**: Inline custom prompt" >> $GITHUB_STEP_SUMMARY | ||
| PROMPT_SOURCE="Inline custom prompt" | ||
| elif [ -n "${{ inputs.custom_prompt_file }}" ]; then | ||
| echo "- **Prompt Source**: \`${{ inputs.custom_prompt_file }}\`" >> $GITHUB_STEP_SUMMARY | ||
| PROMPT_SOURCE="\`${{ inputs.custom_prompt_file }}\`" | ||
| else | ||
| echo "- **Prompt Source**: Default prompt" >> $GITHUB_STEP_SUMMARY | ||
| PROMPT_SOURCE="Default prompt" | ||
| fi | ||
|
|
||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| echo "### Generated Changelog:" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| echo "${{ steps.ai-changelog.outputs.changelog || steps.fallback-changelog.outputs.changelog }}" >> $GITHUB_STEP_SUMMARY | ||
| # Write the entire summary using heredoc to safely handle all content | ||
| cat <<SUMMARY_EOF >> $GITHUB_STEP_SUMMARY | ||
| ## 📝 Changelog Generation Summary | ||
|
|
||
| - **Commit Range**: \`${{ inputs.before_sha }}\` → \`${{ inputs.after_sha }}\` | ||
| - **Generation Method**: ${{ steps.ai-changelog.outcome == 'success' && 'AI-powered ✨' || 'Fallback (commit list) ⚠️' }} | ||
| - **Prompt Source**: $PROMPT_SOURCE | ||
|
|
||
| ### Generated Changelog: | ||
|
|
||
| $CHANGELOG | ||
| SUMMARY_EOF |
There was a problem hiding this comment.
Semgrep identified a blocking 🔴 issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.
You can view more details about this finding in the Semgrep AppSec Platform.
|
Semgrep found 1 $...LIB |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Production Deployment
This PR promotes the
nextbranch tomainfor production release.Commits included (93):
Merge Strategy
Using merge commit to preserve full commit history for changelog generation.
Temporary Branch
This PR is created from a temporary branch
release/next-to-main-20251029-003209that will be deleted after merge.This PR was automatically created by the Update Production workflow.
Changes Summary
✨ Features (6)
🐛 Bug Fixes (10)
📝 Documentation (2)
🔧 Maintenance (37)
Full Commit List