Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/aw/actions-lock.json
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,11 @@
"version": "v8",
"sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
},
"github/gh-aw-actions/setup@v0.64.2": {
"repo": "github/gh-aw-actions/setup",
"version": "v0.64.2",
"sha": "f22886a9607f5c27e79742a8bfc5faa34737138b"
},
"github/gh-aw/actions/setup@v0.55.0": {
"repo": "github/gh-aw/actions/setup",
"version": "v0.55.0",
Expand Down
76 changes: 76 additions & 0 deletions .github/workflows/skill-drift-assign-reviewers.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
# Auto-assign SDK team reviewers on skill-drift PRs based on which skill
# files were modified. Hardcoded mapping — no agent involvement needed.

name: Assign SDK Team Reviewers

on:
pull_request:
types: [opened]
paths:
- "skills/sentry-*-sdk/**"

jobs:
assign-reviewers:
if: contains(github.event.pull_request.labels.*.name, 'skill-drift')
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Label check on opened event will never match

High Severity

The workflow only triggers on pull_request: opened, but the job's if condition checks for the skill-drift label. The GitHub REST API for creating pull requests doesn't support a labels parameter — labels are added in a separate API call after creation. The opened webhook event payload reflects PR state at creation time, before labels are attached. This means github.event.pull_request.labels will always be empty, the contains(...) check will always be false, and the job will never run. Adding labeled to the types list would allow the workflow to also trigger when the label is applied.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 01ca68b. Configure here.

runs-on: ubuntu-latest
permissions:
pull-requests: write
steps:
- name: Assign SDK team reviewers
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistent action version not in lock file

Low Severity

The new workflow pins actions/github-script to SHA 60a0d83039c74a4aee543508d2ffcb1c3799cdea (v7.0.1), while every other workflow in the repository uses v8 (ed597411d8f924073f98dfc5c65a23a2325f34cd). The v7 SHA is also absent from actions-lock.json, breaking the repository's action-pinning convention.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 01ca68b. Configure here.

with:
script: |
// Skill directory → team slug mapping
const SKILL_TEAMS = {
'sentry-android-sdk': 'getsentry/team-mobile',
'sentry-browser-sdk': 'getsentry/team-javascript-sdks',
'sentry-cloudflare-sdk': 'getsentry/team-javascript-sdks',
'sentry-cocoa-sdk': 'getsentry/team-mobile',
'sentry-dotnet-sdk': 'getsentry/team-web-sdk-backend',
'sentry-elixir-sdk': 'getsentry/team-web-sdk-backend',
'sentry-flutter-sdk': 'getsentry/team-mobile-cross-platform',
'sentry-go-sdk': 'getsentry/team-web-sdk-backend',
'sentry-nestjs-sdk': 'getsentry/team-javascript-sdks',
'sentry-nextjs-sdk': 'getsentry/team-javascript-sdks',
'sentry-node-sdk': 'getsentry/team-javascript-sdks',
'sentry-php-sdk': 'getsentry/team-web-sdk-backend',
'sentry-python-sdk': 'getsentry/owners-python-sdk',
'sentry-react-native-sdk': 'getsentry/team-mobile-cross-platform',
'sentry-react-sdk': 'getsentry/team-javascript-sdks',
'sentry-ruby-sdk': 'getsentry/team-web-sdk-backend',
'sentry-svelte-sdk': 'getsentry/team-javascript-sdks',
};
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Team reviewer slugs include invalid org prefix

High Severity

The SKILL_TEAMS mapping values include the getsentry/ organization prefix (e.g., getsentry/team-mobile), but the GitHub REST API's pulls.requestReviewers endpoint expects team_reviewers to be an array of bare team slugs without the org prefix (e.g., team-mobile). Passing org-prefixed values will cause the API call to fail, meaning reviewers will never be assigned — defeating the entire purpose of this workflow.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 01ca68b. Configure here.


// Get changed files
const files = await github.paginate(
github.rest.pulls.listFiles,
{
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: context.payload.pull_request.number,
}
);

// Collect unique teams from changed skill paths
const teams = new Set();
for (const file of files) {
const match = file.filename.match(/^skills\/(sentry-[\w-]+-sdk)\//);
if (match && SKILL_TEAMS[match[1]]) {
teams.add(SKILL_TEAMS[match[1]]);
}
}

if (teams.size === 0) {
console.log('No matching skill directories found in changed files');
return;
}

const teamSlugs = [...teams];
console.log(`Requesting review from: ${teamSlugs.join(', ')}`);

await github.rest.pulls.requestReviewers({
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: context.payload.pull_request.number,
team_reviewers: teamSlugs,
});
Loading
Loading