Skip to content

refactor: replace PR assignee workflow with Slack channel notification#2328

Draft
tomassrnka wants to merge 8 commits intomainfrom
pr-slack-notify
Draft

refactor: replace PR assignee workflow with Slack channel notification#2328
tomassrnka wants to merge 8 commits intomainfrom
pr-slack-notify

Conversation

@tomassrnka
Copy link
Copy Markdown
Member

Summary

  • Deletes the auto-request-same-site workflow that added assignees to PRs
  • Replaces with pr-slack-notify that posts new PRs to #code-review-requests on Slack, tagging @pr-infra
  • No automatic GitHub reviewer or assignee assignment — someone claims from Slack and self-assigns as reviewer
  • CODEOWNERS unchanged (branch protection approval gating only)

Setup required (before merging)

  • Create Slack channel #code-review-requests (or get its ID if it exists)
  • Create Slack user group @pr-infra (or get its ID if it exists)
  • Set repo variable SLACK_CHANNEL_ID — the channel ID
  • Set repo variable SLACK_REVIEW_GROUP — the Slack user group ID for @pr-infra
  • SLACK_BOT_TOKEN secret already exists

Test plan

  • Set up the repo variables with test values
  • Use workflow_dispatch to manually trigger with a test PR
  • Verify message appears in #code-review-requests with @pr-infra tag
  • Open a real PR and verify it posts automatically
  • Verify no assignees or reviewers are auto-added

🤖 Generated with Claude Code

Drop the auto-request-same-site workflow that added assignees to PRs.
Replace with a simpler workflow that posts new PRs to #code-review-requests
on Slack, tagging the @pr-infra user group. No automatic GitHub reviewer
or assignee assignment — someone claims it from Slack and self-assigns.

CODEOWNERS remains unchanged (used for branch protection approval gating).

Setup required:
- Slack channel: #code-review-requests
- Slack user group: @pr-infra
- Repo variables: SLACK_CHANNEL_ID, SLACK_REVIEW_GROUP (Slack user group ID)
- Repo secret: SLACK_BOT_TOKEN (already exists)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@cursor
Copy link
Copy Markdown

cursor bot commented Apr 8, 2026

PR Summary

Medium Risk
Changes PR automation from GitHub-side assignee selection to Slack-based notifications and still runs on pull_request_target, so misconfiguration of Slack variables/secrets could break review routing or leak notifications.

Overview
This PR removes the automation that auto-selected same-site reviewers/assignees (including CODEOWNERS fallback and Slack DMs) and replaces it with a reusable workflow that posts newly opened/ready PRs to a configured Slack channel, tagging a configured review group so reviewers self-assign rather than being assigned automatically.

Reviewed by Cursor Bugbot for commit 0383df4. Bugbot is set up for automated code reviews on this repo. Configure here.

tomassrnka and others added 3 commits April 8, 2026 17:11
Pin dependency versions to prevent supply chain risk. The workflow
has access to SLACK_BOT_TOKEN via pull_request_target, so unpinned
deps could leak the secret if a dependency is compromised.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PR titles are user-controlled and could contain > or <!everyone> to
break link formatting or trigger channel-wide pings. Since the workflow
uses pull_request_target, fork contributors can craft malicious titles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@tomassrnka
Copy link
Copy Markdown
Member Author

bugbot run

Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 6ac8860. Configure here.

@ValentaTomas ValentaTomas removed their assignment Apr 8, 2026
tomassrnka and others added 3 commits April 9, 2026 10:46
Move the PR Slack notification script and logic to the org-level
e2b-dev/.github repo (PR e2b-dev/.github#3). This repo now has a
thin 18-line caller workflow. Any e2b-dev repo can reuse the same
workflow with its own SLACK_REVIEW_GROUP variable.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

Bugbot Autofix prepared fixes for both issues found in the latest run.

  • ✅ Fixed: Missing workflow_dispatch trigger prevents manual testing
    • Added workflow_dispatch trigger with pr_number input to enable manual testing as described in the test plan.
  • ✅ Fixed: Draft PRs trigger premature Slack notifications
    • Added condition if: github.event.pull_request.draft == false to skip notifications for draft PRs.

Create PR

Or push these changes by commenting:

@cursor push 59839a64c2
Preview (59839a64c2)
diff --git a/.github/workflows/pr-slack-notify.yml b/.github/workflows/pr-slack-notify.yml
--- a/.github/workflows/pr-slack-notify.yml
+++ b/.github/workflows/pr-slack-notify.yml
@@ -5,15 +5,23 @@
     types:
       - opened
       - ready_for_review
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to test with'
+        required: true
+        type: number
 
 permissions:
   contents: read
 
 jobs:
   notify:
+    if: github.event.pull_request.draft == false
     uses: e2b-dev/.github/.github/workflows/pr-slack-notify.yml@main
     secrets:
       SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
     with:
       channel_id: ${{ vars.SLACK_CHANNEL_ID }}
       review_group: ${{ vars.SLACK_REVIEW_GROUP }}
+      pr_number: ${{ inputs.pr_number }}

This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 2cdb2cb. Configure here.

pull_request_target:
types:
- opened
- ready_for_review
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Draft PRs trigger premature Slack notifications

Low Severity

The opened event fires for all PRs including drafts. A draft PR will post to #code-review-requests tagging @pr-infra immediately on creation, and then again when marked ready for review via ready_for_review. This results in either a noisy premature notification for drafts, or a duplicate notification for PRs that transition from draft to ready.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2cdb2cb. Configure here.

Allows manual trigger with PR details for testing the Slack
notification without opening a real PR.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants