Skip to content

fix(ci): fix changelog link in the Github-bot#4739

Open
vamshigovardhana wants to merge 1 commit intowebex:nextfrom
vamshigovardhana:bot-comment
Open

fix(ci): fix changelog link in the Github-bot#4739
vamshigovardhana wants to merge 1 commit intowebex:nextfrom
vamshigovardhana:bot-comment

Conversation

@vamshigovardhana
Copy link
Contributor

@vamshigovardhana vamshigovardhana commented Feb 24, 2026

COMPLETES #< https://jira-eng-gpk2.cisco.com/jira/browse/SPARK-754634 >

This pull request addresses

The Git-hub-bot's package detection was inaccurate because it used manual parsing instead of the existing package-tools CLI, which has better support for detecting affected packages and their dependents.

by making the following changes

Replaced manual parsing logic with yarn package-tools for package detection

  • Uses --recursive flag to detect dependent packages (e.g., if @webex/plugin-meetings changes, webex is also detected)
  • Added proper Node.js setup and yarn dependency installation steps
  • Added build step for package-tools before running detection

Change Type

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update
  • Tooling change
  • Internal code refactor

The following scenarios were tested

Vidcast :https://app.vidcast.io/share/281813d7-d374-432f-af52-e4944e7463e3

The GAI Coding Policy And Copyright Annotation Best Practices

  • GAI was not used (or, no additional notation is required)
  • Code was generated entirely by GAI
  • GAI was used to create a draft that was subsequently customized or modified
  • Coder created a draft manually that was non-substantively modified by GAI (e.g., refactoring was performed by GAI on manually written code)
  • Tool used for AI assistance (GitHub Copilot / Other - specify)
    • Github Copilot
    • Other - Please Specify
  • This PR is related to
    • Feature
    • Defect fix
    • Tech Debt
    • Automation

I certified that

  • I have read and followed contributing guidelines
  • I discussed changes with code owners prior to submitting this pull request
  • I have not skipped any automated checks
  • All existing and new tests passed
  • I have updated the documentation accordingly

Make sure to have followed the contributing guidelines before submitting.

@vamshigovardhana vamshigovardhana requested a review from a team as a code owner February 24, 2026 07:22
@vamshigovardhana vamshigovardhana changed the title fix(ci): fix changelog link in PR comment bot fix(ci): fix changelog link in the Github-bot Feb 24, 2026
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 154fe1cb58

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: adc729c74c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 986d420e6e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@vamshigovardhana vamshigovardhana force-pushed the bot-comment branch 2 times, most recently from e8099a8 to 1466c7d Compare February 24, 2026 09:29
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1466c7d336

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b5057218ae

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: af37bf6b66

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

const prNumber = prNumbers[0];
console.log(`Posting comment to PR #${prNumber}`);
try {
const commitsRaw = `${{ steps.get-prs.outputs.commits }}`;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Avoid embedding commits JSON directly in template literal

${{ steps.get-prs.outputs.commits }} is injected into a JavaScript template literal before JSON.parse, so commit subjects containing backticks or ${...} still break script parsing and abort comment posting; this is a realistic input (the repo history already includes backticks in commit titles). Pass the JSON via environment/input encoding rather than source interpolation to keep parsing robust.

Useful? React with 👍 / 👎.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a125197b0c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

# Get packages with --recursive to include dependent packages (like webex)
# This ensures that if @webex/plugin-meetings changes, webex is also detected
if [ -n "$PREVIOUS_TAG" ]; then
PACKAGES=$(yarn package-tools list --recursive --since "$PREVIOUS_TAG" 2>/dev/null || echo "webex")

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Derive changed packages from the same release SHA

Get Merged PRs intentionally computes PRs from github.event.workflow_run.head_sha, but package detection still runs yarn package-tools list --since "$PREVIOUS_TAG" against the checked-out workspace state. When that checkout commit differs from the workflow run head SHA (the exact mismatch this workflow already guards against for PR lookup), the comment can combine PRs from one release with package metadata from another, producing incorrect "Packages updated" content and changelog package links.

Useful? React with 👍 / 👎.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fb9f0daaf5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

echo "📦 Tag: ${VERSION}, PR: #${PR_NUMBER}"
# Production mode: get real version from package-tools
yarn ws:tools
VERSION=$(yarn package-tools sync --tag next --packages webex | awk '{print $3}' | tr -d '%')

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use a read-only command to fetch the release version

Calling yarn package-tools sync --tag next --packages webex here mutates the checkout before later steps run: sync calls pack.apply() (packages/tools/package/src/commands/sync/sync.ts) and Package.apply() rewrites package.json (packages/tools/package/src/models/package/package.ts). When the npm next dist-tag differs from the checked-out webex version, this step dirties the worktree, so the subsequent package-tools list --since ... can treat those local edits as changed packages and post incorrect package/changelog metadata for the release.

Useful? React with 👍 / 👎.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3ca17d8d4f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +45 to +46
if: ${{ github.event_name != 'workflow_dispatch' }}
run: yarn workspaces foreach --from '@webex/*-tools' --topological-dev --parallel --verbose run build:src

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Build package-tools in workflow_dispatch runs

The Build Tools step is explicitly skipped for workflow_dispatch, but Get Changed Packages still runs yarn package-tools list; webex-package-tools requires ./dist/module (packages/tools/package/index.js), and that dist output is not committed, so manual runs hit a runtime failure and fall back to echo "webex". As a result, manually triggered comments can consistently publish incorrect package/changelog metadata instead of the real changed package set.

Useful? React with 👍 / 👎.

@Shreyas281299 Shreyas281299 added the validated If the pull request is validated for automation. label Mar 2, 2026
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ca70f35858

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +423 to +425
const packages = packagesRaw
.replace(/[{}]/g, '')
.split(',')

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Split node-mode package output on whitespace

INPUT_PACKAGES here is wired to needs.generate-package-matrix.outputs.node-recursive, which is produced by yarn package-tools list --mode node and therefore emits package names separated by spaces (see packages/tools/package/src/commands/list/list.ts, packageNames.join(' ')). Splitting only on commas turns multi-package outputs like webex @webex/calling into a single entry, so packages.includes('webex') fails and both the "Packages updated" text and changelog package query can be wrong for normal multi-package releases.

Useful? React with 👍 / 👎.

Copy link
Contributor

@mkesavan13 mkesavan13 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel this PR is not addressing the gap we have today rather taking a whole new route.

@vamshigovardhana - Kindly review the whole code by yourself once and come up with things that seems unnecessary or diverting.

Comment on lines +417 to +420
if (alreadyCommented) {
console.log(`Already commented on PR #${prNumber} for ${version}`);
return;
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we need this step?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mkesavan13 This is a safety check to prevent duplicate comments.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a scenario where duplicate commenting is expected?

git push origin ${{ steps.versionextractor.outputs.version }}
fi

comment-on-prs:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we have everything we need to comment on PRs in deploy.yml now, why do we need pr-comment-bot.yml?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we have everything we need to comment on PRs in deploy.yml now, why do we need pr-comment-bot.yml?

@mkesavan13 You're right, we don't need it anymore. I'll delete pr-comment-bot.yml since the logic has moved into the Deploy CD pipeline.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df83298c4e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".


- name: Get Pull Request Number
id: pr
run: echo "pull_request_number=$(gh pr view --json number -q .number || echo "")" >> $GITHUB_OUTPUT

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Select merged PR by SHA instead of branch default

This job runs on push to next, but gh pr view --json number -q .number is invoked without a PR/branch argument, so it resolves the PR for the currently checked-out branch (next) rather than the PR that introduced the pushed commit. In typical merge-to-next runs there is no PR for next, so pull_request_number is empty and the comment step is skipped entirely; if a long-lived PR from next exists, the bot can comment on that unrelated PR instead. Resolve PRs from the push commit SHA (or merge metadata) so comments target the released PR reliably.

Useful? React with 👍 / 👎.

Comment on lines +417 to +420
if (alreadyCommented) {
console.log(`Already commented on PR #${prNumber} for ${version}`);
return;
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a scenario where duplicate commenting is expected?

Comment on lines +433 to +434
const stableVersion = versionNumber.replace(/-next\..*$/, '');
const changelogUrl = `https://web-sdk.webex.com/changelog/?stable_version=${stableVersion}&package=${primaryPackage}&version=${versionNumber}`;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How does this fix the problem we had of choosing packages[0] while version number was different?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated the approach. Instead of hardcoding --packages webex for the version, I added a new changedpackage step in publish-tag that first picks the package (prefers webex if it's in the changed list, otherwise uses the first changed package), then fetches that same package's version from NPM. Both package_name and package_version are derived from the same variable ($PKG), so the version always corresponds to the selected package. This eliminates the mismatch we had before where the version came from webex but the package could be something else.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 952c81e722

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

if echo "$CLEAN" | tr ',' '\n' | grep -q "^webex$"; then
PKG="webex"
else
PKG=$(echo "$CLEAN" | tr ',' '\n' | head -1 | tr -d ' ')

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Parse node-recursive package list using whitespace separators

needs.generate-package-matrix.outputs.node-recursive comes from yarn package-tools list --mode node, which emits package names space-delimited, but this step treats the value as comma-delimited and then strips spaces; for multi-package outputs like webex @webex/calling, PKG becomes webex@webex/calling. That invalid package name causes yarn package-tools sync --packages $PKG to resolve no workspace and produce an empty version, so downstream PR comments are posted with package_version set to just v and broken release/changelog links.

Useful? React with 👍 / 👎.

Copy link
Contributor

@Shreyas281299 Shreyas281299 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have we tested this? Can you share the github action run for its testing

body: commentBody
});

console.log(`✅ Commented on PR #${prNumber}`);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can remove some of the console.logs.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 449ba90df4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +425 to +427
always() &&
needs.generate-package-matrix.result == 'success' &&
needs.generate-package-matrix.outputs.node-recursive != ''

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Require publish-tag success before posting release comments

This job is allowed to run with always() and only checks generate-package-matrix, so it still executes when publish-tag fails (for example, tag push/API failures) and can post "Your changes are now available" even though the release did not complete. In that failure path, INPUT_VERSION also falls back to a placeholder, so contributors can receive a false production-release notification; gate this job on needs.publish-tag.result == 'success' (and ideally needs.publish-tag.outputs.proceed == 'true').

Useful? React with 👍 / 👎.

if: ${{ steps.pr.outputs.pull_request_number != '' }}
uses: actions/github-script@v7
env:
INPUT_VERSION: ${{ needs.publish-tag.outputs.package_version || 'v0.0.0-dry-run' }}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use release tag version instead of package_version in comment

INPUT_VERSION is sourced from publish-tag.outputs.package_version, but the workflow’s Git tag/release is computed from the versionextractor (webex) version, not the selected package version. When the chosen package is not webex (or package dist-tags diverge), the comment’s "Released in" link and changelog version query can point to a non-existent release version, producing broken or misleading metadata.

Useful? React with 👍 / 👎.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2846d2e977

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +424 to +427
if: |
always() &&
needs.generate-package-matrix.result == 'success' &&
needs.generate-package-matrix.outputs.node-recursive != ''

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Gate PR comments on successful publish-tag completion

This job is forced to run via always() and only checks generate-package-matrix, so it still executes when publish-npm/publish-tag fails or is skipped. In those failure paths the comment step can still post a "released" message (using fallback values), which tells contributors their change is live even though the release pipeline did not complete successfully. Add a needs.publish-tag.result == 'success' guard (or equivalent) before posting comments.

Useful? React with 👍 / 👎.

if: ${{ steps.pr.outputs.pull_request_number != '' }}
uses: actions/github-script@v7
env:
INPUT_VERSION: ${{ needs.publish-tag.outputs.package_version || 'v0.0.0-dry-run' }}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use published tag version for comment links

INPUT_VERSION is sourced from package_version, but the GitHub tag in this workflow is derived from publish-tag's tag version output. When a release updates a non-webex package, package_version can differ from the created tag (or no new tag is created), so the comment's release/changelog links point at a non-existent version. Use the tag version output for link construction, or skip link posting when no tag was produced.

Useful? React with 👍 / 👎.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a49b2c0402

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +425 to +427
always() &&
needs.generate-package-matrix.result == 'success' &&
(needs.generate-package-matrix.outputs.node-recursive != '' || inputs.pr_number != '')

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Gate PR comments on successful publish-tag result

The comment-on-prs job is forced by always() and only checks generate-package-matrix, so it can still post “Your changes are now available” when publish-npm/publish-tag failed or was skipped, using fallback values instead of an actual released tag. In push-triggered failures this sends false release notifications to PRs; add a success guard for needs.publish-tag.result before posting comments.

Useful? React with 👍 / 👎.

if: ${{ steps.pr.outputs.pull_request_number != '' }}
uses: actions/github-script@v7
env:
INPUT_VERSION: ${{ needs.publish-tag.outputs.package_version || 'v0.0.0-dry-run' }}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use tag version for release link instead of package version

The comment step sets INPUT_VERSION from package_version, but this workflow creates/pushes tags from versionextractor (the release tag version). When the selected package differs from webex, the generated “Released in” link can target a non-existent releases/tag/<package_version> and misreport the actual release artifact. Use the publish-tag version output for the release URL and keep package version separate for package/changelog details.

Useful? React with 👍 / 👎.

@vamshigovardhana vamshigovardhana requested a review from a team as a code owner March 9, 2026 06:09
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 601ced18f3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +434 to +436
always() &&
needs.generate-package-matrix.result == 'success' &&
(needs.generate-package-matrix.outputs.node-recursive != '' || inputs.pr_number != '')

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Gate PR comment on successful publish

This job runs under always() and only requires generate-package-matrix to succeed, so it can still execute after publish-npm/publish-tag failures and post "Your changes are now available" even though the release did not complete; in that failure path, INPUT_VERSION falls back to test/default values, which makes the comment content and release link incorrect for production push runs. Restrict this job to successful publish/tag outcomes (or explicitly branch to test-only behavior for workflow_dispatch) before posting user-facing release comments.

Useful? React with 👍 / 👎.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3a4cc48bc

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +434 to +436
always() &&
needs.generate-package-matrix.result == 'success' &&
(needs.generate-package-matrix.outputs.node-recursive != '' || inputs.pr_number != '')

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Gate PR comments on successful publish-tag completion

This job is configured with always() and only checks generate-package-matrix, so it still runs when publish-npm/publish-tag fails or is skipped on a real push release run. In that failure path the comment step can still post "Your changes are now available" using fallback values (for example v0.0.0-dry-run from INPUT_VERSION), which produces false release notifications and broken links for contributors even though the publish did not complete.

Useful? React with 👍 / 👎.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95293cb21c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +30 to +32
uses: actions/checkout@v3
with:
fetch-depth: 0

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Checkout workflow_run head SHA before resolving release tag

In .github/workflows/webex-space-bot.yml, the workflow_run path checks out the repo without a ref and then derives VERSION from git describe --tags; that makes the selected tag depend on whatever commit was checked out rather than the Deploy CD run’s head commit. When the checked-out ref differs (for example, default branch or a newer commit), the bot can announce the wrong release/PR/changelog in Webex. Pin checkout to github.event.workflow_run.head_sha (or resolve tags from that SHA) before extracting tag metadata.

Useful? React with 👍 / 👎.

exit 1
fi
TAG_MESSAGE=$(git tag -l --format='%(contents:subject)' "$VERSION")
PR_NUMBER=$(echo "$TAG_MESSAGE" | grep -oE '#[0-9]+' | head -1 | tr -d '#')

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Extract PR number from merge trailer instead of first #token

The PR extraction command uses grep -oE '#[0-9]+' | head -1, which picks the first #<number> anywhere in the tag message subject. If the subject includes other references (for example issue IDs or revert subjects with multiple PR numbers), this will target the wrong PR and then compute package/changelog context from unrelated changes. Parse only the final merge trailer PR token (or map by commit SHA) to avoid misdirected notifications.

Useful? React with 👍 / 👎.

Comment on lines +425 to +429
const existingComments = await github.rest.issues.listComments({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: prNumber
});

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Paginate comment lookup before duplicate-checking release note

The duplicate-check only inspects the single page returned by issues.listComments, but that API returns 30 comments by default. On PRs with more comments, an existing bot release comment can be outside this page, so reruns post duplicate “Your changes are now available” messages. Use github.paginate (or explicit paging) when searching existing comments.

Useful? React with 👍 / 👎.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c1d8573fe7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +425 to +429
const existingComments = await github.rest.issues.listComments({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: prNumber
});

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Catch GitHub API failures in PR comment step

This script performs issues.listComments/issues.createComment without any error handling, so transient GitHub API failures (rate limiting, token permission changes, or temporary API errors) will throw and fail the entire Deploy CD workflow even though package publish/tagging has already completed. Because this comment job now runs inline in deploy, a non-critical notification failure can incorrectly mark production deploys as failed; wrap the API section in try/catch (or continue-on-error) to keep deploy status reliable.

Useful? React with 👍 / 👎.

Copy link
Contributor

@Shreyas281299 Shreyas281299 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we post the testing github run here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

validated If the pull request is validated for automation.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants