[PM-32685] Send cherry-pick slack message to QA

[mpbw2]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-32685

📔 Objective

When changed are cherry-picked to a release/ branch, a :cherry-pick: slack message pinging @group-qa is generated with a link to the commit

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed a new CI workflow (.github/workflows/send_slack_notification.yml) that posts a :cherry-pick: Slack notification pinging QA when commits land on a release/ branch. The Azure login, Key Vault secret retrieval, release/**/* branch filter, and pinned Slack action version all match established patterns in the repo's existing workflows (build.yml, test.yml). Commit values are passed through environment variables rather than inline interpolation, avoiding script-injection risk.

The one open thread — workflow_dispatch producing a malformed message because github.event.head_commit is null — has already been raised and acknowledged by the author as temporary testing scaffolding that will be removed. No new findings.

Code Review Details

No new findings. The previously raised workflow_dispatch question is acknowledged as temporary and out of scope.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.49%. Comparing base (329643c) to head (22a4273).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7151   +/-   ##
=======================================
  Coverage   86.49%   86.49%           
=======================================
  Files         908      908           
  Lines       65230    65230           
  Branches     9600     9600           
=======================================
  Hits        56422    56422           
  Misses       5365     5365           
  Partials     3443     3443           

Flag	Coverage Δ
app-data	17.31% <ø> (ø)
app-ui-auth-tools	18.63% <ø> (ø)
app-ui-platform	16.58% <ø> (ø)
app-ui-vault	28.14% <ø> (ø)
authenticator	6.15% <ø> (ø)
lib-core-network-bridge	4.05% <ø> (ø)
lib-data-ui	1.14% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

❓ QUESTION: On workflow_dispatch, github.event.head_commit is null, so this sends a malformed message to QA.

Details

The if condition on line 18 (github.event_name != 'push' || ...) intentionally lets manual dispatch runs through. But on a workflow_dispatch event, github.event.head_commit is null, so COMMIT_URL and COMMIT_SHA resolve to empty strings. The resulting Slack message becomes:

:cherry-pick: <|>  into *<branch>*
cc <!subteam^S022CDR7W2Z> <@U06538MSPJP>

i.e. an empty link <|> and no commit reference, which still pings @group-qa.

Is workflow_dispatch intended only for testing? If so, consider gating the message-build/send behind a push event, or populating the commit fields from github.sha as a fallback so a manual run doesn't ping QA with an empty commit link.

[mpbw2]

It's for testing and will be removed later

[vvolkgang]