Open
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a manual GitHub Actions workflow and a Python script that collect merged PRs' "#### Release Note" sections across specified repos, optionally polish notes with Anthropic Claude, prepend a versioned entry to a changelog file, and open a PR with the result. Changes
Sequence Diagram(s)sequenceDiagram
actor User
participant Actions as "GitHub Actions"
participant GH as "GitHub API"
participant Script as "generate_changelog.py"
participant Claude as "Claude (Anthropic API)"
participant Docs as "Docs Repo"
User->>Actions: workflow_dispatch (milestone, version, server_repos, changelog_path)
Actions->>GH: request App installation token
GH-->>Actions: installation token
Actions->>Docs: checkout docs repo (with token)
Actions->>Script: run script (env: GITHUB_TOKEN, VERSION, MILESTONE, REPOS, ANTHROPIC_API_KEY)
Script->>GH: list milestones per repo
GH-->>Script: milestone IDs
Script->>GH: fetch closed issues/PRs for milestone
GH-->>Script: PR metadata
Script->>Script: extract Jira links & release notes
alt ANTHROPIC_API_KEY present
Script->>Claude: send raw notes for polishing
Claude-->>Script: polished notes
else
Script->>Script: format raw notes as bullets
end
Script->>Docs: prepend generated changelog entry to file
Docs-->>Script: file updated
Actions->>GH: push branch & create PR to master
GH-->>User: PR created
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 9bb74c4 |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA c561a08 |
amyblais
changed the title
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA a79aeb5 |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 132cd17 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/generate-changelog.yml:
- Around line 52-59: The workflow job "Generate changelog" is running the wrong
script path; update the run command to call the new location of the script
(scripts/generate_changelog.py) so the runner executes the file added in this
PR; locate the job named "Generate changelog" and change the run entry from
"python .github/scripts/generate_changelog.py" to run "python
scripts/generate_changelog.py" (or alternatively move the script into
.github/scripts if you prefer to keep the original path).
- Around line 72-76: The GH CLI invocation in the gh pr create step hard-codes
the target branch via the --base main flag; change that to use the repository's
actual default branch by replacing the literal --base main with --base ${{
github.event.repository.default_branch }} so the PR opens against the repo's
default branch at runtime (update the gh pr create command invocation).
In `@scripts/generate_changelog.py`:
- Around line 34-47: The category headings in the generated changelog are being
emitted at the same level as the release header (because the prompt asks for
`##` headings) so change the prompt/template in scripts/generate_changelog.py
where `entry` is built (it currently starts with `## {VERSION} - {today}`) so
that all subsequent category headings use `###` instead of `##` and also ensure
the prompt instructs the generator to omit any empty categories; update the
string/variable that defines the list of categories to request `### User
Interface`, `### Administration`, etc., and confirm the code that appends
categories only includes non-empty ones.
- Around line 56-68: The milestone lookup in the function that queries url =
f"https://api.github.com/repos/{repo}/milestones" only checks the first page and
must be paginated like get_merged_prs(); update the logic to follow pagination
(use resp.links.get("next") or loop incrementing params["page"]) and iterate
through every page's resp.json() checking m["title"] == title, returning
m["number"] as soon as a match is found; only after exhausting all pages should
you print the "Milestone ... not found" message and return None, reusing
HEADERS, params and the existing resp.raise_for_status() pattern.
- Around line 161-168: Wrap the API call to client.messages.create(...) in a
try-except that catches any Exception; on success continue to return
response.content[0].text.strip() as before, but on failure log the exception (or
use processLogger) and return the already-available plain bullet list of raw
notes instead (e.g., join the raw notes into "- item" lines or call the existing
fallback formatter used for missing API key/package). Apply this change around
the client.messages.create(...) call and reference the variables client,
user_message, SYSTEM_PROMPT and response when editing.
- Around line 58-59: The requests.get() calls in generate_changelog.py (the one
that assigns resp and the second at the later call) lack explicit timeouts,
which can hang CI; update both requests.get(...) invocations to include a
timeout parameter (e.g., timeout=30) so the call fails fast on unresponsive
GitHub endpoints—locate the occurrences around the resp = requests.get(url,
headers=HEADERS, params=params) assignment and the second requests.get usage and
add timeout=30 to their argument lists.
- Around line 88-91: The PR filter inside the loop over items incorrectly checks
item["pull_request"].get("merged_at") so merged PRs are never detected; update
the check to use the top-level merged_at field by replacing
item["pull_request"].get("merged_at") with item.get("merged_at") in the loop
that builds prs (variables: items, item, prs) so merged pull requests are
correctly appended.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a02297b8-d09d-40c4-87de-647be57ab533
📒 Files selected for processing (2)
.github/workflows/generate-changelog.ymlscripts/generate_changelog.py
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 37ea628 |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA e9d880f |
amyblais
added
Work In Progress
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 6bb6cfc |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 497e0c6 |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA a3cba5d |
Member
Author
|
@coderabbitai help |
ChatThere are 3 ways to chat with CodeRabbit:
CodeRabbit commands
Other keywords and placeholders
CodeRabbit configuration file (
|
Member
Author
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA a18a89e |
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/generate-changelog.yml (1)
49-50: Pin workflow Python dependencies for reproducible runs.Installing unpinned
requestsandanthropiccan introduce non-deterministic failures when upstream releases change behaviour.🔧 Proposed fix
- - name: Install dependencies - run: pip install requests anthropic + - name: Install dependencies + run: pip install -r .github/scripts/requirements-generate-changelog.txtYou can keep exact pins in
.github/scripts/requirements-generate-changelog.txtand update them deliberately.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/generate-changelog.yml around lines 49 - 50, The workflow step "Install dependencies" currently runs an unpinned pip install of requests and anthropic; change it to install pinned dependencies from the requirements file instead (e.g. replace the run command with pip install -r .github/scripts/requirements-generate-changelog.txt) and add that requirements file with exact version pins for requests and anthropic (and any other Python deps used by the changelog generator) so CI runs are reproducible; update the workflow step name "Install dependencies" if needed to reflect the pinned install.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/scripts/generate_changelog.py:
- Line 85: The requests.get calls (e.g., the assignment to resp using
requests.get(url, headers=HEADERS, params=params)) lack timeouts and can block;
update both occurrences (the top-level requests.get and the one inside the
pagination loop) to pass a timeout argument (e.g., timeout=10 or a defined
constant like REQUEST_TIMEOUT_SECS) and propagate that constant to both calls so
they share the same value; ensure you import or define the timeout constant near
module-level configuration and add the timeout kwarg to requests.get(...)
invocations that use HEADERS/params and the paginated requests.
- Around line 222-229: Wrap the Anthropic API call (client.messages.create(...))
and the subsequent return of response.content[0].text.strip() in a try/except
block: catch broad exceptions from network/API/unexpected response shapes, log
or print the exception, and on any failure return the existing formatted
fallback (formatted raw_notes) used elsewhere in this script; use the same
variables referenced (client, SYSTEM_PROMPT, user_message, response) and ensure
the fallback path returns a string consistent with previous fallbacks so
transient API errors do not abort changelog generation.
- Around line 115-118: The loop that builds prs is checking merged_at at the top
level (item.get("merged_at")) which is always absent; update the filter to read
the nested field item["pull_request"]["merged_at"] (or use
item.get("pull_request", {}).get("merged_at")) so the condition correctly
detects merged PRs when iterating items and appends them to prs in
generate_changelog.py.
- Around line 84-95: get_milestone_number currently fetches only the first 100
milestones and can miss matches; change it to use pagination like get_merged_prs
by introducing a page loop (e.g., page = 1; while True) and include "page" in
params (params = {"state":"all","per_page":100,"page": page}), call
requests.get/resp.raise_for_status for each page, inspect resp.json() and return
m["number"] as soon as a matching m["title"] == title is found, break/return
when the returned list is empty (no more pages), and only then print the
not-found message and return None; keep using the existing HEADERS and variable
names.
---
Nitpick comments:
In @.github/workflows/generate-changelog.yml:
- Around line 49-50: The workflow step "Install dependencies" currently runs an
unpinned pip install of requests and anthropic; change it to install pinned
dependencies from the requirements file instead (e.g. replace the run command
with pip install -r .github/scripts/requirements-generate-changelog.txt) and add
that requirements file with exact version pins for requests and anthropic (and
any other Python deps used by the changelog generator) so CI runs are
reproducible; update the workflow step name "Install dependencies" if needed to
reflect the pinned install.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: aa5e819f-edb3-4bdf-9cb4-7f90453d798b
📒 Files selected for processing (2)
.github/scripts/generate_changelog.py.github/workflows/generate-changelog.yml
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 5a358ff |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 57a178f |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 6e2cc91 |
amyblais
added
1: Dev Review
Move all ${{ inputs.* }} and ${{ vars.* }} expressions out of shell
`run:` blocks into `env:` mappings. Direct interpolation into shell
scripts allows crafted input values to execute arbitrary commands and
exfiltrate secrets.
Made-with: Cursor
SHA-pin actions/checkout (v4.3.1) and actions/setup-python (v5.6.0) to prevent supply chain attacks via compromised floating tags. Pin pip packages requests and anthropic to specific versions. Made-with: Cursor
Delete the incomplete first definition (a leftover merge/edit artifact) that was immediately shadowed by the real implementation. Made-with: Cursor
Made-with: Cursor
The requests.get call in get_merged_prs was missing a timeout, unlike get_milestone_number which already had timeout=30. A missing timeout could hang the CI runner indefinitely on a stalled connection. Made-with: Cursor
Replace hardcoded timeout values with REQUEST_TIMEOUT_SECONDS so the value is defined once and used consistently across all API calls. Made-with: Cursor
Without this, simultaneous dispatches for the same version would race on the branch push and PR creation, causing unpredictable results. Made-with: Cursor
esarafianou
approved these changes
Mar 20, 2026
Contributor
esarafianou
left a comment
esarafianou
left a comment
There was a problem hiding this comment.
Thanks Amy! Just pushed a few changes mostly around CI workflows best practices.
@NARSimoes could you review the PR as well? Now that i've committed code, my review shouldn't count.
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA e5512dd |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/scripts/generate_changelog.py:
- Around line 207-247: The fallback branches in polish_with_ai() currently
prepend "- " to each note but don't indent continuation lines, breaking
Markdown; update every fallback return in polish_with_ai (the three places that
return "\n".join(f"- {note}" ...)) to normalize multi-line notes by replacing
internal newlines with "\n " (e.g., "- " + note.replace("\n", "\n ")) so
continuation lines are indented and remain part of the same Markdown bullet;
also apply the same normalization to the other similar fallback code block
mentioned in the diff to keep behavior consistent.
- Around line 146-152: The current scan only checks pr.get("title") for bare
ticket keys (variable bare_keys) and misses keys referenced in the PR body;
update the logic to search a combined string of title and body (e.g., combine
pr.get("title") and pr.get("body") into one text before calling re.findall) so
bare_keys includes tokens from both, then construct the Jira URL (constructed =
f"https://mattermost.atlassian.net/browse/{key}") and append to full_urls only
if not already present, preserving the existing duplicate check.
- Around line 257-262: The current logic in prepend_to_changelog (handling
variable existing and building new_content using parts[0]/parts[2]) inserts the
entry after the page title and before any intro blocks; instead locate the first
release heading (a line starting with "## ") in existing and insert the new
entry immediately before that heading so intro/directive blocks remain above the
generated changelog entry. Update the branch that checks existing.startswith("#
") to scan existing.splitlines() for the first index where line.startswith("##
"), then reconstruct new_content by joining lines up to that index, inserting
entry + a blank line, and appending the remaining lines; keep references to
existing, parts, and new_content to minimize changes elsewhere.
In @.github/workflows/generate-changelog.yml:
- Around line 10-18: The workflow hard-codes the changelog target to v11 while
advertising a generic inputs.version; update the steps that write/read the
changelog (where the workflow currently references the v11 changelog path) to
derive the path from the inputs.version value (e.g., use inputs.version to build
the target path like `${{ inputs.version }}/changelog.md`) or add a new input
(e.g., inputs.target_path) and use that instead; locate the usage of
inputs.version and the two hard-coded v11 references and replace them so the
workflow writes the changelog to the version-specific path instead of always
v11.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 877b1ea2-548c-41ad-a7e6-b8f956b32abf
📒 Files selected for processing (2)
.github/scripts/generate_changelog.py.github/workflows/generate-changelog.yml
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 8c7df92 |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/scripts/generate_changelog.py:
- Around line 267-273: The current search for a "## Release" heading (variable
release_match) doesn't match the generated entries like "## 10.6 - 2026-03-20",
so new entries are inserted in the wrong place; update the regular expression
used for release_match to match any level-2 heading that looks like a version
entry or the word "Release" (e.g., accept "## Release ..." OR "## <version> -
<date>" / numeric semantic-version style), keep the existing insertion logic
that uses insert_at/new_content and entry/existing unchanged so new entries are
placed at the top of the version list in correct chronological order.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 6c4d5e34-99c0-43ca-af81-0cd31ec10127
📒 Files selected for processing (1)
.github/scripts/generate_changelog.py
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA e41443e |
Contributor
|
Newest code from mattermost has been published to preview environment for Git SHA 173317b |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Created with the help of Claude Cowork 🤖
Add a new workflow that:
Summary by CodeRabbit