Conversation
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
9 issues found across 13 files
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name=".github/workflows/api-changelog.yml">
<violation number="1" location=".github/workflows/api-changelog.yml:55">
P1: **Security: Script injection vulnerability.** Directly interpolating `${{ steps.oasdiff.outputs.changelog }}` into a shell script allows command injection if the changelog contains shell metacharacters. Use an environment variable instead.</violation>
<violation number="2" location=".github/workflows/api-changelog.yml:83">
P1: **Security: Script injection vulnerability.** Directly interpolating `${{ steps.oasdiff.outputs.changelog }}` into a JavaScript template literal allows script injection if the changelog contains backticks or `${...}`. Use environment variables with `process.env` instead.</violation>
<violation number="3" location=".github/workflows/api-changelog.yml:84">
P2: **Potential runtime error.** If `breaking_count` is empty, this produces invalid JavaScript (`const breaking = > 0;`). Add a fallback: `${{ steps.check_changes.outputs.breaking_count || 0 }}`.</violation>
</file>
<file name="fern/changelog/2025-10-28.mdx">
<violation number="1" location="fern/changelog/2025-10-28.mdx:34">
P2: The changelog uses `<CodeBlock>` with only a Python snippet. The guidelines require `<CodeBlocks>` with both Python and TypeScript blocks (with titles) so readers get the language toggle and consistent formatting.</violation>
</file>
<file name="fern/changelog/overview.mdx">
<violation number="1" location="fern/changelog/overview.mdx:3">
P3: Replace the relative RSS link with an absolute `https://docs.agentmail.to/...` URL to follow the changelog link guidelines.</violation>
</file>
<file name="fern/changelog/2025-07-20.mdx">
<violation number="1" location="fern/changelog/2025-07-20.mdx:2">
P3: Use only the documented tag categories in frontmatter. Remove the extra `real-time` tag to keep tags aligned with the changelog taxonomy.</violation>
<violation number="2" location="fern/changelog/2025-07-20.mdx:38">
P2: Use the required `<CodeBlocks>` component with both Python and TypeScript examples so the changelog matches the documented format.</violation>
</file>
<file name="fern/changelog/TEMPLATE.mdx">
<violation number="1" location="fern/changelog/TEMPLATE.mdx:28">
P2: Breaking change examples must use `<CodeBlocks>` with both Python and TypeScript fences; `<CodeBlock>` is disallowed by the changelog guidelines.</violation>
</file>
<file name="fern/changelog/2025-12-22.mdx">
<violation number="1" location="fern/changelog/2025-12-22.mdx:2">
P3: Replace the `events` tag with a supported taxonomy tag (or drop it) so the frontmatter matches the changelog guidelines.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
@cubic-dev-ai some changes to fix the stuff you mentioned. how we looking now? |
@tanishq-atm I don't see any prior review comments from me in this PR's history, so I'll give you a fresh review of the current state. Overall, this is looking really solid. The changelog automation workflow is well-structured, and the documentation guidelines in AGENTS.md are comprehensive. Here are a few observations: What's working well:
Minor polish suggestions:In const body = `## ${breaking ? '🚨 Breaking' : '✨'} API Changes\n\n\`\`\`markdown\n${diff}\n\`\`\`\n\n💡 Download \`api-changelog-diff\` artifact or tag @Fern Writer in #github-prs for changelog.`;The diff is already markdown from oasdiff, so wrapping it in In changelog entries:
In You're in great shape to merge this. The automation will comment on PRs with Fern definition changes, and the guidelines ensure consistent, high-quality changelog entries. Nice work! 🚀 |
2 participants
Summary by cubic
Automates API changelog generation for Fern definition changes and publishes a Changelog section in docs, fulfilling ENG-213. Adds a GitHub Action that diffs OpenAPI changes and comments on PRs; includes guidelines, template, and initial entries.
New Features
Dependencies
Written for commit 8bd64e3. Summary will update on new commits.