Conversation
- Dual checkout: caller repo as source/, plugins repo as tooling/ - Add pr_body input as alternative to changelog (extracts ### Changelog section) - Make CHANGELOG optional in submit-plugin.ts when PR_BODY is provided - Pass changelog as explicit parameter through function chain NOTE: tooling repo temporarily points to niekert/plugins for testing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- New check-pr.yml: reusable workflow for PR validation + auto-labeling - shippy.yml now calls check-pr.yml instead of inlining the logic - validate-pr-body.ts also outputs changelog text (multiline GITHUB_OUTPUT) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…n dlx yarn dlx tsx can't resolve local imports (./lib/parse-pr) because it runs from a temp directory. Use proper install with working-directory instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
validate-pr-body.ts only imports node builtins + local files, so we don't need yarn install at all. npx tsx handles it. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Comment @cursor review or bugbot run to trigger another review on this PR
| - name: Checkout tooling | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: niekert/plugins |
There was a problem hiding this comment.
Hardcoded personal fork instead of organization repository
High Severity
Both check-pr.yml and submit-plugin.yml check out tooling from niekert/plugins (a personal fork) instead of framer/plugins (the canonical organization repository, as confirmed in packages/plugin-tools/package.json). This means CI workflows will pull and execute scripts from a personal fork, which is both a correctness and supply-chain risk.
Additional Locations (1)
| with: | ||
| script: | | ||
| const labels = context.payload.pull_request.labels || [] | ||
| const hasSubmitLabel = labels.some(label => label.name === 'Submit on merge') |
There was a problem hiding this comment.
Renamed label breaks auto-submit-on-merge trigger
High Severity
The new check-pr.yml checks for and auto-applies the label 'Submit on merge', but the existing submit-on-merge.yml workflow triggers only when the label 'Auto submit to Marketplace on merge' is present. This label name mismatch means auto-labeled PRs will never trigger the submission workflow on merge, silently breaking the auto-publish pipeline.
Additional Locations (1)
1 participant
Description
This pull request …
Changelog
Testing