Repository navigation
Feat/node24 - #2
Merged
Merged
Conversation
Support `inputs` context
Bumps [cross-spawn](https://github.com/moxystudio/node-cross-spawn) from 7.0.3 to 7.0.6. - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) --- updated-dependencies: - dependency-name: cross-spawn dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [axios](https://github.com/axios/axios) from 1.6.8 to 1.7.9. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.6.8...v1.7.9) --- updated-dependencies: - dependency-name: axios dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…xios-1.7.9 Bump axios from 1.6.8 to 1.7.9
Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.7 to 4.7.9. - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.7...v4.7.9) --- updated-dependencies: - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [axios](https://github.com/axios/axios) from 1.7.9 to 1.14.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.9...v1.14.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.14.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.2.2 to 3.4.2. - [Commits](WebReflection/flatted@v3.2.2...v3.4.2) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2. - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) --- updated-dependencies: - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Node.js 20 actions are deprecated and will be forced to run with Node.js 24 starting June 2nd, 2026. Closes act10ns#284 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bump Node.js runtime from 20 to 24
Steps without an explicit "id" in GitHub Actions workflows are assigned auto-generated 32-character hex identifiers that display as ugly noise in Slack messages. Filter these out so only explicitly named steps are reported. Closes act10ns#131 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Run prettier on new/modified files to pass CI lint check. Remove dist/ from version control. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Retry up to 3 times with linear backoff (1s, 2s, 3s) when the Slack webhook send fails due to transient network errors like ECONNRESET. Closes act10ns#196 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Filter out steps with auto-generated hex hash IDs
Add retry logic for Slack webhook send
Document how to report on the overall status of a multi-job workflow using a final notify job with the needs context. Closes act10ns#225 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add workflow-level status example to README
Allow the channel input to accept multiple channels separated by spaces or commas. The message is sent to each channel in sequence. Closes act10ns#231 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace the flat list of template variables with a detailed table including descriptions and usage examples. Closes act10ns#246 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Support multiple notification channels
Document all supported template variables
Add a blocks_only option to the config file that omits the default legacy attachment and sends only the blocks attachment. This is backwards compatible — existing configs are unaffected. Closes act10ns#258 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add blocks_only config option for blocks-only messages
Migrate from ncc to esbuild, upgrade to @actions/github v9
Escape newlines, tabs, backslashes, and quotes in block context values before they are interpolated into the blocks JSON template. Multi-line commit messages contain literal newlines that break JSON.parse(). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fix JSON control character error in blocks template
The rebuild-dist commit only changes dist/, which is not in the rebuild-dist paths filter, so it won't create a loop. Removing [skip ci] allows build-test to run against the updated dist, fixing the stale-dist race condition. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove [skip ci] from rebuild-dist to fix stale dist race
All jobs now build fresh dist before using ./ so they don't depend on committed dist being up-to-date. Fixes stale dist race condition where build-test runs before rebuild-dist has updated dist. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Build dist before using action in CI test and lint jobs
- escapeHandlebars: JSON-escape all string values (newlines, quotes,
backslashes) in addition to Handlebars {{ syntax
- Use noEscape option for fields/blocks Handlebars templates to prevent
HTML entity encoding (e.g. ") which breaks JSON parsing
- Add sanitizeJsonString safety net for any remaining control chars
- Add 4 new tests with blocks config covering multi-line messages,
tabs, quotes, backslashes, and mixed Handlebars+newlines
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…yload Fix JSON parsing of blocks/fields with special characters in payload
- Document escapeHandlebars JSON escaping, noEscape, sanitizeJsonString - Document config file warning - Add CI workflows section explaining build-test and rebuild-dist Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update CLAUDE.md with recent patterns and CI workflows
Author
|
To discuss: this looks like it's a "shield" fork - meaning, just allows us to gate updates. Right now, our github actions are pointing to a specific version (2.1.0) - it might be worthwhile considering ways to make company-wide updates easier (ie, to shift the burden of consumer update) by either:
|
|
Just pinging copilot to see if there are any security related changes we need to be aware of. |
There was a problem hiding this comment.
Pull request overview
This PR upgrades the GitHub Action to support Node.js 24 and updates the build/lint/tooling stack accordingly, while extending Slack message features (multi-channel, workflow inputs, blocks-only mode) and hardening message rendering / delivery behavior.
Changes:
- Upgrade runtime/tooling for Node 24 (action runtime, TypeScript target/module settings, dependency bumps, move bundling from
ncctoesbuild, new ESLint flat config). - Extend notification capabilities (multi-channel
channel, newinputsaction input +jobInputstemplating, optionalblocks_onlymode, filter auto-generated step IDs). - Add resilience/safety work (Slack webhook retries, JSON sanitization for JSON-templated fields/blocks, new tests + CI workflow adjustments, add
rebuild-distworkflow).
Reviewed changes
Copilot reviewed 37 out of 46 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
tsconfig.json |
Updates TS target/module settings for modern Node and disables emit (type-check only). |
src/slack.ts |
Core Slack payload building: adds inputs/blocks-only, step filtering, retry logic, and JSON templating/sanitization changes. |
src/main.ts |
Reads new inputs input, adds multi-channel splitting, and improves config-missing warning. |
src/handlebars.ts |
Minor cleanup in conditional helpers. |
README.md |
Documents new inputs/multi-channel/blocks-only behavior and updates examples/links. |
package.json |
Upgrades dependencies, switches bundling to esbuild, adds overrides. |
eslint.config.js |
Introduces ESLint v9 flat config replacement for .eslintrc.json. |
dist/sourcemap-register.js |
Removes old bundled artifact. |
dist/licenses.txt |
Removes old bundled license artifact (replaced by esbuild legal output). |
dist/index.js.LEGAL.txt |
Adds esbuild-generated linked legal notices. |
CLAUDE.md |
Adds contributor-facing project/build/CI notes and new conventions. |
action.yml |
Sets runtime to node24 and adds inputs action input + updated channel description. |
.github/workflows/workflow.yml |
Adds minimal permissions and hardens checkout (pinned ref, no persisted creds). |
.github/workflows/test.yml |
CI hardening (permissions, npm ci, Node 24, avoid Slack posting on PRs). |
.github/workflows/schedule.yml |
Adds permissions, uses npm ci, hardens checkout. |
.github/workflows/rebuild-dist.yml |
New workflow to rebuild/commit dist/ on master when sources change. |
.github/workflows/manual.yml |
Adds permissions, uses npm ci, hardens checkout. |
.github/workflows/custom.yml |
Adds permissions, uses npm ci, hardens checkout. |
.github/workflows/codeql-analysis.yml |
Hardens checkout and pins CodeQL action SHAs. |
.github/slack.yml |
Adds default “Job Inputs” field in sample config. |
.eslintrc.json |
Removes legacy ESLint config (replaced by flat config). |
.eslintignore |
Removes legacy ignore file (handled by flat config ignores). |
__tests__/workflow_run.test.ts |
Updates send() signature usage to include jobInputs. |
__tests__/workflow_dispatch.test.ts |
Updates send() signature usage to include jobInputs. |
__tests__/schedule.test.ts |
Updates send() signature usage to include jobInputs. |
__tests__/release.test.ts |
Updates send() signature usage to include jobInputs. |
__tests__/push.test.ts |
Updates send() signature usage to include jobInputs. |
__tests__/pull_request.test.ts |
Updates send() signature usage to include jobInputs. |
__tests__/job_status.test.ts |
Updates send() signature usage to include jobInputs. |
__tests__/job_matrix.test.ts |
Updates send() signature usage to include jobInputs. |
__tests__/inputs.test.ts |
Updates send() signature usage to include jobInputs. |
__tests__/sanitize.test.ts |
New tests covering templating/JSON-safety scenarios. |
__tests__/retry.test.ts |
New tests covering Slack webhook retry behavior. |
__tests__/multi_channel.test.ts |
New tests covering multi-channel sends. |
__tests__/job_inputs.test.ts |
New tests validating jobInputs rendering. |
__tests__/filter_steps.test.ts |
New tests validating filtering of auto-generated step IDs. |
__tests__/blocks_only.test.ts |
New tests validating blocks-only mode behavior. |
__mocks__/@actions/github.js |
Adds mock GitHub context module. |
__mocks__/@actions/core.js |
Adds mock core module (inputs/logging). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+8
to
+11
| function escapeHandlebars(obj: any): any { | ||
| if (typeof obj === 'string') { | ||
| return JSON.stringify(obj.replace(/\{\{/g, '\\{{')).slice(1, -1) | ||
| } |
Comment on lines
+19
to
+23
| plugins: { | ||
| '@typescript-eslint': tseslint, | ||
| jest | ||
| }, | ||
| rules: { |
Comment on lines
+55
to
+56
| .reply(config => { | ||
| console.log(config.data) |
Comment on lines
+72
to
+73
| .reply(config => { | ||
| console.log(config.data) |
| mockAxios | ||
| .onPost() | ||
| .reply(config => { | ||
| console.log(config.data) |
Comment on lines
+346
to
+350
| const sanitizeJsonString = (s: string): string => | ||
| s.replace(/[\x00-\x1f\x7f]/g, c => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0')) | ||
| const fieldsJson = fieldsTemplate(data) | ||
| core.debug(fieldsJson.toString()) | ||
| const fields = JSON.parse(fieldsTemplate(data)) | ||
| const fields = JSON.parse(sanitizeJsonString(fieldsTemplate(data))) |
Rohland
approved these changes
May 4, 2026
Rohland
left a comment
Rohland
left a comment
There was a problem hiding this comment.
Can't see any security related concerns.
jondrummond-codeo
approved these changes
May 4, 2026
Author
|
@Rohland what do you think of the proposals for making company-wide upgrades easier? IE,
|
|
@fluffynuts I'm ok with @latest for a forked version like this |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrades to the latest upstream for node24 support.