Skip to content

feat(github): add trusted data to check events - #1363

Merged
dcramer merged 3 commits into
mainfrom
feat/check-resource-event-data
Aug 10, 2026
Merged

feat(github): add trusted data to check events#1363
dcramer merged 3 commits into
mainfrom
feat/check-resource-event-data

Conversation

@sentry-junior

@sentry-junior sentry-junior Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Fixes #1362.

Check suite events only said that checks failed or recovered. Junior then had to look up the head SHA, suite link, and failed checks.

This PR adds optional trusted data on resource events. GitHub check suite events fill that data with system ids and urls:

  • PR number and repo
  • full head SHA
  • suite id and browser url (built by Junior; GitHub does not send html_url)
  • suite conclusion and app name
  • failed check-run ids/urls when enrichment works

Failed check names are workflow-controlled, so they go in untrustedText, not trusted data.

On failed suites, Junior may load failed check runs with one installation-token call scoped to that suite. If that call fails, the event still includes the suite facts from the webhook.

checks.recovered means one suite recovered. It does not mean the whole PR is green.

Ops note: the GitHub App needs Checks: Read to load failed check-run ids/urls.

Give check suite events action handles (SHA, suite id/url, failing checks)
so Junior can act without rediscovering CI state on every turn.

Co-Authored-By: David Cramer <david@sentry.io>
@vercel

vercel Bot commented Aug 9, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
junior-docs Ready Ready Preview Aug 9, 2026 11:49pm

Request Review

Comment thread packages/junior/src/chat/event-tasks/ingest.ts
@sentry-junior sentry-junior Bot changed the title feat(github): enrich check resource events with trusted data feat(github): add trusted data to check events Aug 9, 2026
Simplify issue, PR, docs, and agent-facing wording around trusted check event data.

Co-Authored-By: David Cramer <david@sentry.io>
@dcramer
dcramer marked this pull request as ready for review August 9, 2026 23:34
@github-actions github-actions Bot added the risk: high PR risk score: high label Aug 9, 2026

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 3255ea7. Configure here.

Comment thread packages/junior-github/src/webhooks/check-suite-enrichment.ts Outdated
Comment thread packages/junior-github/src/webhooks/resource-events.ts Outdated
Review feedback: check-run names are workflow-controlled, so put them in
untrustedText. Load failing runs by suite id, and build the suite browser
url ourselves because GitHub does not send html_url on check suites.

Co-Authored-By: David Cramer <david@sentry.io>
@sentry-junior

sentry-junior Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor Author

Addressed the three review findings in dbea380:

  1. Trusted data / prompt injection: check-run names are no longer in trusted data. They go in untrustedText only. Trusted failingChecks keeps system handles: checkRunId, conclusion, and htmlUrl. Agent copy now says trusted data is system ids/urls.
  2. Suite scope: enrichment loads /check-suites/{id}/check-runs instead of commit-wide latest runs. selectFailingChecks also drops runs that name a different suite id.
  3. Suite URL: Junior builds checkSuiteUrl from repo + head SHA + suite id. We no longer read check_suite.html_url from the webhook.

@dcramer
dcramer merged commit 82436f6 into main Aug 10, 2026
42 checks passed
@dcramer
dcramer deleted the feat/check-resource-event-data branch August 10, 2026 00:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk: high PR risk score: high

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add useful data to GitHub check events

1 participant