Repository navigation
Align deployment notifications and GitHub run summaries - #10
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| writeFileSync(summaryPath, ""); | ||
| writeFileSync( | ||
| preload, | ||
| `const fs=require('node:fs');let requests=0;process.once('exit',()=>fs.writeFileSync(${JSON.stringify(requestsPath)},String(requests)));global.fetch=async(url,init)=>{requests++;url=String(url);if(!['https://auth.example.invalid','https://portalapi.commerce.ondemand.com'].includes(new URL(url).origin))throw Error('Unexpected network destination');if(init.redirect!=='error')throw Error('Unsafe redirects');if(url.includes('oauth2'))return Response.json({access_token:'SYNTHETIC_BUNDLE_TOKEN',token_type:'Bearer'});if(init.method==='POST')return Response.json({code:'synthetic.1'},{status:201});if(url.endsWith('/progress'))return Response.json({deploymentStatus:${JSON.stringify(status === "handoff" ? "DEPLOYING" : status)},percentage:90});if(url.endsWith('/decisions'))return Response.json({deploymentDecisions:[]});return Response.json({code:'synthetic.1',status:'DEPLOYING',strategy:${JSON.stringify(status === "handoff" ? "GREEN" : "ROLLING_UPDATE")},isCanaryAvailable:${status === "handoff"},canaryStatus:'STARTED',expireAtTimestamp:'2099-01-01T00:00:00Z'});};`, |
| writeFileSync(summaryPath, ""); | ||
| writeFileSync( | ||
| preload, | ||
| `const fs=require('node:fs');let requests=0;process.once('exit',()=>fs.writeFileSync(${JSON.stringify(requestsPath)},String(requests)));global.fetch=async(url,init)=>{requests++;url=String(url);if(!['https://auth.example.invalid','https://portalapi.commerce.ondemand.com'].includes(new URL(url).origin))throw Error('Unexpected network destination');if(init.redirect!=='error')throw Error('Unsafe redirects');if(url.includes('oauth2'))return Response.json({access_token:'SYNTHETIC_BUNDLE_TOKEN',token_type:'Bearer'});if(init.method==='POST')return Response.json({code:'synthetic.1'},{status:201});if(url.endsWith('/progress'))return Response.json({deploymentStatus:${JSON.stringify(status === "handoff" ? "DEPLOYING" : status)},percentage:90});if(url.endsWith('/decisions'))return Response.json({deploymentDecisions:[]});return Response.json({code:'synthetic.1',status:'DEPLOYING',strategy:${JSON.stringify(status === "handoff" ? "GREEN" : "ROLLING_UPDATE")},isCanaryAvailable:${status === "handoff"},canaryStatus:'STARTED',expireAtTimestamp:'2099-01-01T00:00:00Z'});};`, |
| writeFileSync(summaryPath, ""); | ||
| writeFileSync( | ||
| preload, | ||
| `const fs=require('node:fs');let requests=0;process.once('exit',()=>fs.writeFileSync(${JSON.stringify(requestsPath)},String(requests)));global.fetch=async(url,init)=>{requests++;url=String(url);if(!['https://auth.example.invalid','https://portalapi.commerce.ondemand.com'].includes(new URL(url).origin))throw Error('Unexpected network destination');if(init.redirect!=='error')throw Error('Unsafe redirects');if(url.includes('oauth2'))return Response.json({access_token:'SYNTHETIC_BUNDLE_TOKEN',token_type:'Bearer'});if(init.method==='POST')return Response.json({code:'synthetic.1'},{status:201});if(url.endsWith('/progress'))return Response.json({deploymentStatus:${JSON.stringify(status === "handoff" ? "DEPLOYING" : status)},percentage:90});if(url.endsWith('/decisions'))return Response.json({deploymentDecisions:[]});return Response.json({code:'synthetic.1',status:'DEPLOYING',strategy:${JSON.stringify(status === "handoff" ? "GREEN" : "ROLLING_UPDATE")},isCanaryAvailable:${status === "handoff"},canaryStatus:'STARTED',expireAtTimestamp:'2099-01-01T00:00:00Z'});};`, |
This was referenced Nov 15, 2026
Merged
Merged
anilkreddy
marked this pull request as ready for review
November 15, 2026 04:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The deploy Action now reports its effective inputs, status and safe failure/issue details consistently through the existing notification contract and GitHub run summary. Shared status icons, Result/Inputs/Issues tables and workflow links apply to success and handled failures. Four authentication fields are always literal
[REDACTED]; known credentials/tokens, mixed-case URI/form encodings, private URL shapes and Slack webhook variants are redacted before bounding and escaping.All 21 input names appear. Decision/cancellation reasons and traffic-split JSON use presence-only previews even on invalid configuration. Human result rows include cancellation, rollback and traffic-update details. Existing action-required handoff keeps the warning style and existing exit policy. Six new standalone bundle cases cover success, failure, cancellation, unknown status, invalid input and manual-green handoff, plus the existing bundle test. Invalid configuration performs zero mocked API requests.
Reporting failures preserve the original domain outcome and available outputs. Output writes are independent; a runner output failure is reported separately, with the original operation error kept primary. Trusted local enums stay truthful when a credential coincidentally equals a status/operation word; copied input values remain masked. Structured JSON is bounded to 64 KiB with Unicode/overflow regression coverage. No Action input or API/auth/transport/state-machine behavior changed.
Published dependency and normal build
The owner authorized package publication and source merges when green. Action-kit #13 merged to main
3fecce40414d709884fa48e48eca278f470b20b0; package-only run 43678067818 successfully published actualnotification-contract@0.0.6. Main CI/CodeQL passed, including processed analysis 2169851728. Independent registry read-back confirms:8030f643d1dd6d741caa2c3c0ba321ad82b30cca.sha512-n6F84900sDPBeYm5dnf8HLCM9B2DUVATEeF717dqKsSXTJtq1FIj/3hZ2UcNTtXe7v8R90HYF6HIom4auM8Kyw==.e4b79576328c2992a96fed087e9ba6e63970e8b54d6fca976a6652702a7a73a9, identical to the reviewed v2 tarball from source475cc4db42f79310240496201f90d7047aa54330.The normal manifest and lockfile now pin exact registry 0.0.6, with ccv2-client 0.0.3 unchanged. Dist is regenerated from the actual registry package. Candidate-only environment/file-tarball switching is removed from current validation. Historical procedures are archived through immutable source links; no local dependency or copied shared source is needed. Runtime consumers need no installation or registry credential.
Validation actually run
Node 24.21.0 and pnpm 12.6.0: registry dependency resolution,
pnpm install --frozen-lockfile,pnpm bundleand normalpnpm qualityall PASS with no candidate environment variable. This includes format, lint, strict types, public schema/compatibility checks, 312 tests in 12 files with zero skipped, standalone bundle scenarios, byte consistency, 65-file public scan and production dependency audit (no known vulnerabilities).Coverage: 99.12% statements, 97.48% branches, 98.57% functions, 99.76% lines; existing 95% thresholds and source inclusion were not weakened. Normal committed bundle SHA256:
540d42a2072000d1ffa884c22a7eac933233a5a584c6831be85a1472d1e7744e, identical to the independently tested v2 candidate. Final source commit:71acea3d4ced7876ff89fe316d175b205d8ce5fa. The dependency-publication blocker is resolved, and all hosted checks on this exact final head passed. This PR merged after green hosted checks and normal-registry integration validation.No Action release, Git tag, Marketplace publication, deployment, live provider send, hosted Sandbox dispatch or real SAP operation was performed. Existing live validation and owner Action-release gates remain separately documented. No failing workflow check was bypassed; the final security review additionally inspected processed findings.
Detailed validation and remaining gates.
Coordinated review set:
Final hosted registry-backed checks
Exact head
71acea3d4ced7876ff89fe316d175b205d8ce5fais green: CI 43678636872 passed quality and all Ubuntu/Windows/macOS platform jobs; CodeQL 43678636888 and processed PR CodeQL 132704384412 both passed. No check or protection was bypassed.Final coordinated registry validation
All seven original PRs are merged. The dependency-publication/adoption blocker is resolved. Each Action uses actual registry notification-contract 0.0.6 with a frozen reproducible lockfile and regenerated committed bundle. No candidate flag or local package link is required.
Final verified main
1af852b9a00e981da4ea13565bb18c7ce7fda27f: CI/validate 43680764774 and CodeQL 43680764683 PASS. Exact-main processed analysis2169935725has zero results, empty error/warning fields and zero open main alerts.Final registry-installed validation report and sanitized exact-source/bundle evidence: 76 harness tests and the final 24-record five-action integration replay PASS. Four isolated local Sandbox runs were removed with absence verified; Cleanup performed zero target mutations. All 16 provider requests were strict mocks.
The final processed security review found five generated-code alerts in new Build/Deploy test preloads despite green workflow jobs. Narrow test-only follow-ups Build #10 and Deploy #11 removed data-to-code interpolation, passed full validation, and resolved all findings. Production source and bundle hashes are unchanged. Setup used its existing OrganizationAdmin merge exception after all six native jobs, quality and CodeQL passed; no branch rules were changed.
Only the requested shared package was published. No Git tags, Action releases, deployments, hosted Sandbox dispatches, live notifications or real SAP operations occurred. Production cleanup eligibility and separately authorized live/release validation gates remain closed.
Companions: action-kit #13, notify #19, ccv2-build #8, ccv2-deploy #10, setup-commercekit #14, ccv2-build-cleanup #8, action-integration-tests #3.