Repository navigation
ci: add release Slack summary caller workflow - #38717
Draft
vpintorico wants to merge 5 commits into
Draft
vpintorico wants to merge 5 commits into
vpintorico wants to merge 5 commits into
Conversation
Call the shared github-tools release-slack-summaries action on weekday schedules and manual dispatch. Real Slack channels and PR writes stay off unless GA_MODE is live. Co-authored-by: Victor Pinto <vpintorico@users.noreply.github.com>
Follow the input names and PR-write rule from github-tools#306, and reference branch cursor/release-slack-summaries-a324 until it merges. Co-authored-by: Victor Pinto <vpintorico@users.noreply.github.com>
allow-pr-write is armed only for a live release-validation run that is not a dry run and has no test channel. Zap 597 still rewrites the release PR body during the parallel run. Co-authored-by: Victor Pinto <vpintorico@users.noreply.github.com>
Contributor
Author
|
Automated adversarial review (Warden), not a human review Head: aa723af · Verdict: blocked · Fix round: 0 New findings
Other bots
Dropped2 |
Fixes Warden F1 Fixes Warden F2 Fixes Warden F3 Fixes Warden F4 Fixes Warden F5 Fixes Warden F7 Documents Warden F6: every run still requests pull_requests write. The token-exchange policy for this workflow was specified with that scope, and a read-only request was not confirmed as allowed. F4 pins github-tools release-slack-summaries to f99347bfb23bbbd352d199be7b58b3d7cb9f9bb9, which is still the head of draft PR 306 on cursor/release-slack-summaries-a324. Co-authored-by: Victor Pinto <vpintorico@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # github-tools-ref is the same SHA so the action's second checkout | ||
| # follows this commit rather than the branch tip. | ||
| - name: Post release Slack summary | ||
| uses: MetaMask/github-tools/.github/actions/release-slack-summaries@f99347bfb23bbbd352d199be7b58b3d7cb9f9bb9 # cursor/release-slack-summaries-a324 (github-tools#306) |
Comment on lines
+248
to
+259
| const proc = spawnSync( | ||
| 'bash', | ||
| [ | ||
| '-c', | ||
| 'source "$1"; release_slack_summaries_concurrency_suffix "$2" "$3"', | ||
| 'bash', | ||
| scriptPath, | ||
| schedule, | ||
| mode, | ||
| ], | ||
| { encoding: 'utf8' }, | ||
| ); |
Contributor
Author
|
Automated adversarial review (Warden), not a human review Head: 33bcab0 · Verdict: blocked · Fix round: 1 Since last review
Open findings at this head
New findingsNone. Other bots
Dropped3 |
Fixes Warden F3, F7 A live post reads RELEASE_SUMMARY_BLOCKER_JQL and RELEASE_SUMMARY_REGRESSION_JQL and fails unless both are set. While GA_MODE is not live, a Slack channel id is accepted only when it equals RELEASE_SUMMARY_TEST_CHANNEL. Co-authored-by: Victor Pinto <vpintorico@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #38717 +/- ##
=======================================
Coverage 87.63% 87.63%
=======================================
Files 7967 7975 +8
Lines 231645 231724 +79
Branches 58693 58706 +13
=======================================
+ Hits 202997 203072 +75
- Misses 16302 16305 +3
- Partials 12346 12347 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Contributor
Author
|
Automated adversarial review (Warden), not a human review Head: 905a023 · Verdict: pass with notes · Fix round: 2 Since last review
Open findings at this head (minor, left for the owner's decision)
New findingsF8, F9, F10 above (all minor). Other bots
Dropped1 |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds
.github/workflows/release-slack-summaries.yml, the MetaMask Mobile caller for MCRM-155. Zapier Zaps 596 (release blocker summary) and 597 (release validation summary, including the release PR body sign-off rewrite) are moving to GitHub Actions. The summary logic lives inMetaMask/github-tools/.github/actions/release-slack-summaries(draft PR 306). This repo only gets the thin caller.Mode and safety flags are resolved by
.github/scripts/release-slack-summaries-flags.sh. The caller:16 10 * * 1-5UTC asblocker-summaryand21 10 * * 1-5UTC asrelease-validation, plusworkflow_dispatch(mode,dry-rundefault true,test-channel).release-notificationsand permissionsid-token: writepluscontents: readon that job (contents: readis also the workflow default).MetaMask/github-tools/.github/actions/get-token@v1. Every run, including blocker-summary and dry runs, requestspull_requests: writefor this repo.MetaMask/MetaMask-planningiscontents: read. No personal access tokens. A read-only pull request token was not requested: policy PR 221 was specified withpull_requests: writefor this workflow, and a narrower request was not confirmed as allowed.f99347bfb23bbbd352d199be7b58b3d7cb9f9bb9(cursor/release-slack-summaries-a324, github-tools#306) and passes the same SHA asgithub-tools-ref.platform: mobile, the existingSLACK_BOT_TOKENsecret (the oneslack-rc-notification.ymluses), andJIRA_EMAIL/JIRA_API_TOKENfrom the environment.vars.RELEASE_SUMMARY_BLOCKER_JQLandvars.RELEASE_SUMMARY_REGRESSION_JQLand fails unless both are set. Dry runs and non-live runs may use preview defaults when those variables are empty. The preview defaults are not the MCRM-155 queries. The action still appends its own version custom fields to the base it receives.GITHUB_OUTPUT. Safety outputs are written after the JQL lines.GA_MODEis not exactlylive:#release-*andrelease-*names are rejected.C…/G…id is accepted only when it equals the validatedRELEASE_SUMMARY_TEST_CHANNEL. Any other id is rejected.test-channelinput replaces the variable when it is non-empty. If neither is set, the run dry-runs and posts nothing.allow-pr-writeonly whenGA_MODEis exactlylive, mode isrelease-validation, dry-run is false, and no test channel is set. A test channel blocks the PR rewrite even in live mode, because Zap 597 still rewrites the release PR body during the parallel run. github-tools#306 deviation 3 is not followed.This repo's default branch is
main, which matches the token-exchange policy refrefs/heads/main.Prerequisites
.github/workflows/release-slack-summaries.yml@refs/heads/mainin environmentrelease-notifications.TODO(MCRM-155)pin must move fromf99347bfb23bbbd352d199be7b58b3d7cb9f9bb9to the merged commit SHA or release tag.github-tools-refmust move with it.release-notificationsmust exist on this repo. Scheduled runs need to be allowed through without a manual approval gate.JIRA_EMAILandJIRA_API_TOKENare added to that environment by the owner later. This PR does not create secrets.SLACK_BOT_TOKENis the existing secret.TOKEN_EXCHANGE_URLis the existing repository variable used by the other get-token callers.GA_MODEshould stay unset ortestuntil go-live.RELEASE_SUMMARY_TEST_CHANNELmust be set before a non-live run is expected to post. AC…/G…id is allowed on that path only when it is this variable.RELEASE_SUMMARY_BLOCKER_JQLandRELEASE_SUMMARY_REGRESSION_JQLonce version scoping is confirmed, or once github-tools#306 can substitutelabels = "regression-RC-{V}". A live post stays blocked until both variables are set. The same variable names are used by metamask-extension#47572.Open items
usespin is the reviewed github-tools#306 head, not the merge commit. Move it, andgithub-tools-ref, after that PR merges. Do not setGA_MODE=liveuntil that pin is the merged revision and both JQL variables are set.cf[14565] = "V"andcf[16946] = "V"to the caller base. It does not substituteregression-RC-{V}.cf[16946]is marked open to confirm in that action, and Release Numbercf[14565]is piloted in ASSETS only (MCRM-154). This caller does not invent those clauses.workflow_dispatchfrom any branch other thanmainwill fail token exchange, because policy PR 221 pinsrefs/heads/main.run.mjs), and it does not implement the ticket'steam-*labels, Exalate-as-unassigned, or the GitHub-issue merge.GA_MODEis exactlyliveand no test channel is set, or the owner setRELEASE_SUMMARY_TEST_CHANNELto that channel's id. Nothing rewrites a release PR body unlessGA_MODEis exactlylive, mode isrelease-validation, the run is not a dry run, and no test channel is set.Code owners for
.github/workflows/are MetaMask/devops and MetaMask/mobile-platform. No CODEOWNERS edit: the existing workflows rule already covers this file.Run the resolver tests with
node --test .github/scripts/release-slack-summaries-flags.test.mjs. CI unit tests run.github/**/*.test.tsonly, so this.test.mjsis not on that job.Changelog
CHANGELOG entry: null
Related issues
Refs: MCRM-155
Manual testing steps
N/A for the product app. This is a GitHub Actions caller and must not be dispatched until the prerequisites above are done. A live dispatch stays failed until both JQL repository variables are set.
After those land, and with
GA_MODEunset ortestandRELEASE_SUMMARY_TEST_CHANNELset to a non-release#nameor to the id that should be allowed:Screenshots/Recordings
N/A. Workflow-only change, no UI.
Before
N/A
After
N/A
Pre-merge author checklist
Performance checks (if applicable)
trace()for usage andaddTokenfor an exampleFor performance guidelines and tooling, see the Performance Guide.
Pre-merge reviewer checklist