Files
composiohq__composio/.github/workflows/docs.changelog-notification.yml
Alberto Schiabel 503b50ab02 chore(deps): refresh SDK, Python, and CI dependencies (#3955)
This PR:

- splits https://github.com/ComposioHQ/composio/pull/3953 in two: this
PR carries every dependency and GitHub Actions bump **except** the docs
site, which follows in a stacked PR
- consolidates and supersedes Dependabot PRs #3915, #3916, and #3934
through #3942
- adopts TypeScript 7.0.2 for primary compilation while retaining the
`@typescript/typescript6` API lane that TypeScript-ESLint still
requires, following the upstream side-by-side guidance
- refreshes Python core and provider dependencies, lockfiles, and the
Ruff 0.16 lint configuration
- updates every GitHub Action with a verified newer official release,
including majors, while retaining immutable commit SHA pins and
migrating setup-uv cache pruning
- deletes four per-package `eslint.config.mjs` shims: under ESLint 10
the default per-file config lookup re-anchors the root config's globs
into each package, so `pnpm lint` stayed green while the CLI's
try/catch, `process.env` and node-builtin bans went unenforced
- bounds and documents the new `brace-expansion` and `@hono/node-server`
security overrides, raising the `@hono/node-server` floor to 2.0.10 to
clear GHSA-9mqv-5hh9-4cgg
- preserves intentional compatibility fixtures and lanes for AI SDK 6,
Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints

## Context

The docs site is a separate Bun workspace with its own `bun.lock` and is
not a pnpm workspace member, so the two halves share no lockfile and no
build. Splitting them keeps the Fumadocs 11 migration (a breaking API
change with real refactoring) reviewable on its own, independently of
the mechanical version bumps here.

The `brace-expansion` override deliberately spans majors:
GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with
no 1.x or 2.x backport, so narrowing it to the 5.x line puts
`brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and
`pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the
trade-off it buys is recorded inline in `pnpm-workspace.yaml`.

Verified on this branch standalone: `pnpm install --frozen-lockfile`,
`pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963
tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`.
2026-07-27 17:57:29 +05:30

111 lines
4.5 KiB
YAML

name: Changelog Notification
on:
push:
branches: [next]
paths:
- 'docs/content/changelog/**.mdx'
permissions:
contents: read
jobs:
notify-changelog:
name: Send Changelog Notification
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # Fetch full history to detect changes across all commits in push
- name: Get Changed Changelog Files
id: changed-files
run: |
# Get the commit range for this push
BEFORE="${{ github.event.before }}"
AFTER="${{ github.event.after }}"
echo "Push event details:"
echo " Before: $BEFORE"
echo " After: $AFTER"
echo " Commits in push: $(git rev-list --count "$BEFORE".."$AFTER" 2>/dev/null || echo "N/A")"
# Handle first push to branch (before SHA is all zeros)
if [[ "$BEFORE" =~ ^0+$ ]]; then
echo "First push to branch detected, checking only the latest commit"
CHANGED_FILES=$(git diff --name-only --diff-filter=AM HEAD^..HEAD | grep '^docs/content/changelog/.*\.mdx$' || echo "")
else
echo "Checking all commits in push range: $BEFORE..$AFTER"
# Get the list of added/modified changelog files across all commits in this push
CHANGED_FILES=$(git diff --name-only --diff-filter=AM "$BEFORE".."$AFTER" | grep '^docs/content/changelog/.*\.mdx$' || echo "")
fi
if [ -z "$CHANGED_FILES" ]; then
echo "No changelog files changed in this push"
echo "has_changelog=false" >> $GITHUB_OUTPUT
else
echo "Changelog files found:"
echo "$CHANGED_FILES"
# Get the first changelog file (in case multiple were added)
CHANGELOG_FILE=$(echo "$CHANGED_FILES" | head -n 1)
echo ""
echo "Processing changelog: $CHANGELOG_FILE"
echo "changelog_file=$CHANGELOG_FILE" >> $GITHUB_OUTPUT
echo "has_changelog=true" >> $GITHUB_OUTPUT
fi
- name: Extract Changelog Metadata
if: steps.changed-files.outputs.has_changelog == 'true'
id: extract-metadata
run: |
CHANGELOG_FILE="${{ steps.changed-files.outputs.changelog_file }}"
# Extract title from frontmatter
TITLE=$(grep "^title:" "$CHANGELOG_FILE" | sed "s/^title: *['\"]*//" | sed "s/['\"]* *$//")
# Extract date from frontmatter
DATE=$(grep "^date:" "$CHANGELOG_FILE" | sed "s/^date: *['\"]*//" | sed "s/['\"]* *$//")
# Format date for URL (YYYY-MM-DD to YYYY/MM/DD)
URL_DATE=$(echo "$DATE" | sed 's/-/\//g')
# Build the changelog URL
CHANGELOG_URL="https://docs.composio.dev/docs/changelog/${URL_DATE}"
# Get the commit author who added/modified this changelog
AUTHOR=$(git log -1 --format='%an' -- "$CHANGELOG_FILE")
AUTHOR_EMAIL=$(git log -1 --format='%ae' -- "$CHANGELOG_FILE")
# Build properly escaped JSON payload using jq
SLACK_PAYLOAD=$(jq -n \
--arg title "$TITLE" \
--arg date "$DATE" \
--arg url "$CHANGELOG_URL" \
--arg author "$AUTHOR" \
'{text: "*New Changelog Published*\n\n*\($title)*\n\nDate: \($date)\n<\($url)|View Changelog>\nAuthor: \($author)"}')
echo "title=$TITLE" >> $GITHUB_OUTPUT
echo "date=$DATE" >> $GITHUB_OUTPUT
echo "url=$CHANGELOG_URL" >> $GITHUB_OUTPUT
echo "author=$AUTHOR" >> $GITHUB_OUTPUT
echo "author_email=$AUTHOR_EMAIL" >> $GITHUB_OUTPUT
# Save the JSON payload for the next step
echo "slack_payload<<EOF" >> $GITHUB_OUTPUT
echo "$SLACK_PAYLOAD" >> $GITHUB_OUTPUT
echo "EOF" >> $GITHUB_OUTPUT
echo "📝 Changelog Title: $TITLE"
echo "📅 Date: $DATE"
echo "🔗 URL: $CHANGELOG_URL"
echo "👤 Author: $AUTHOR ($AUTHOR_EMAIL)"
- name: Send Slack Notification
if: steps.changed-files.outputs.has_changelog == 'true'
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
with:
webhook: ${{ secrets.SLACK_CUSTOMER_COMMS_WEBHOOK_URL }}
webhook-type: incoming-webhook
payload: ${{ steps.extract-metadata.outputs.slack_payload }}