Repository navigation
feat: share consistent action notifications and run summaries - #13
Merged
Merged
Conversation
This was referenced Nov 15, 2026
This was referenced Nov 15, 2026
anilkreddy
marked this pull request as ready for review
November 15, 2026 04:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Shared CommerceKit Action reporting now has one status/icon/tone contract, confidential-first input capture, safe bounded input snapshots and an escaped GitHub run-summary renderer. The genuine setup-completed event and optional Check/Build/Deploy input/issue context are additive; existing domain outcomes, Cleanup's exact input schema and OAuth/transport remain unchanged.
Merged and published as authorized: PR #13 merged to action-kit main
3fecce40414d709884fa48e48eca278f470b20b0after all PR checks passed. That exact main passed CI 43677942127 including all three platforms and CodeQL 43677942074. Processed analysis 2169851728 has empty error/warning fields, with no open main alerts before publication.Package-only workflow 43678067818 succeeded and published only notification-contract 0.0.6. It verified immutable-version absence, exact-main CI/CodeQL, full quality and the selected installed/tested tarball, then used
npm publish --ignore-scripts. The registry version and integrity were independently read back. No Git tag or GitHub/Action Release was created.Published artifact: 19140 bytes, shasum
8030f643d1dd6d741caa2c3c0ba321ad82b30cca, SHA256e4b79576328c2992a96fed087e9ba6e63970e8b54d6fca976a6652702a7a73a9, integritysha512-n6F84900sDPBeYm5dnf8HLCM9B2DUVATEeF717dqKsSXTJtq1FIj/3hZ2UcNTtXe7v8R90HYF6HIom4auM8Kyw==. These match the reviewed source artifact from475cc4db42f79310240496201f90d7047aa54330; the packaged README captures its pre-publication candidate stage. Registry evidence and consumer lockfiles are authoritative for adoption.Validation: 394 tests / 12 files PASS, notification-contract coverage 100% statements, 99.64% branches, 100% functions/lines; all existing 95% thresholds preserved. Packed ESM/schema/declaration/public-export checks, public scan and dependency audit passed. Regressions cover mixed-case percent-encoded known secrets, canonical webhook hosts, forged snapshots, escaped/bounded summaries and all status semantics. The existing CCv2 client package is unchanged.
All five consumers now pin the exact published registry version with regenerated lockfiles and normal standalone bundles. Full normal validation, security analysis and configured native-platform checks passed. Candidate validation is retained as historical evidence.
Companions: Setup #14, Build #8, Deploy #10, Cleanup #8, Notify #19, integration #3.
No Action release, Git tag, deployment, live notification, hosted Sandbox dispatch or real SAP operation. Real cleanup eligibility and owner release gates remain closed.
Final coordinated registry validation
All seven original PRs are merged. The dependency-publication/adoption blocker is resolved. Each Action uses actual registry notification-contract 0.0.6 with a frozen reproducible lockfile and regenerated committed bundle. No candidate flag or local package link is required.
Final verified main
3fecce40414d709884fa48e48eca278f470b20b0: CI/validate 43677942127 and CodeQL 43677942074 PASS. Exact-main processed analysis2169851728has zero results, empty error/warning fields and zero open main alerts.Final registry-installed validation report and sanitized exact-source/bundle evidence: 76 harness tests and the final 24-record five-action integration replay PASS. Four isolated local Sandbox runs were removed with absence verified; Cleanup performed zero target mutations. All 16 provider requests were strict mocks.
The final processed security review found five generated-code alerts in new Build/Deploy test preloads despite green workflow jobs. Narrow test-only follow-ups Build #10 and Deploy #11 removed data-to-code interpolation, passed full validation, and resolved all findings. Production source and bundle hashes are unchanged. Setup used its existing OrganizationAdmin merge exception after all six native jobs, quality and CodeQL passed; no branch rules were changed.
Only the requested shared package was published. No Git tags, Action releases, deployments, hosted Sandbox dispatches, live notifications or real SAP operations occurred. Production cleanup eligibility and separately authorized live/release validation gates remain closed.
Companions: action-kit #13, notify #19, ccv2-build #8, ccv2-deploy #10, setup-commercekit #14, ccv2-build-cleanup #8, action-integration-tests #3.