Repository navigation
Conversation
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 1 file
Auto-approved: Wraps globalThis.fetch so the Workers HTTP API transport retains fetch's global receiver, fixing a TypeError during identity sync; focused one-line bug fix with tests passing.
Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack
Turn on auto-fix | Re-trigger cubic
admdly
changed the title
There was a problem hiding this comment.
0 issues found across 3 files (changes from recent commits).
Auto-approved: Fixes the HTTP transport fetch binding and isolates branch previews to the staging API with synthetic data; remaining changes are docs and regenerated Wrangler types. Bounded to preview configuration plus a focused bug fix.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 2 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
Dismissed because Cubic found issues in a newer review.
There was a problem hiding this comment.
0 issues found across 4 files (changes from recent commits).
Requires human review: Adds OIDC-based callback reconciliation for branch Previews, switches Previews to a staging API/dev OAuth client, and fixes the HTTP fetch receiver. The new auth-service integration and preview exposure are the decisive human decisions.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
2 issues found across 9 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="scripts/sync-preview-callbacks.ts">
<violation number="1" location="scripts/sync-preview-callbacks.ts:48">
P1: The Preview API is being addressed with `script.tag`, which is an immutable deployed script tag rather than the `extensions` Worker name. Use the configured Worker name/ID for `/workers/workers/{worker}/previews`; otherwise the workflow cannot read previews and never reconciles callbacks.</violation>
<violation number="2" location="scripts/sync-preview-callbacks.ts:66">
P2: A Preview without a routable `urls` array crashes reconciliation at `flatMap`, preventing all callback updates. Treat missing URLs as empty with `preview.urls ?? []` and model the field as optional.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
| for (let page = 1; ; page++) { | ||
| const data = await readJson<Page<Preview>>( | ||
| fetcher, | ||
| `${base}/workers/workers/${service.result.default_environment.script.tag}/previews?per_page=100&page=${page}`, |
There was a problem hiding this comment.
P1: The Preview API is being addressed with script.tag, which is an immutable deployed script tag rather than the extensions Worker name. Use the configured Worker name/ID for /workers/workers/{worker}/previews; otherwise the workflow cannot read previews and never reconciles callbacks.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At scripts/sync-preview-callbacks.ts, line 48:
<comment>The Preview API is being addressed with `script.tag`, which is an immutable deployed script tag rather than the `extensions` Worker name. Use the configured Worker name/ID for `/workers/workers/{worker}/previews`; otherwise the workflow cannot read previews and never reconciles callbacks.</comment>
<file context>
@@ -0,0 +1,110 @@
+ for (let page = 1; ; page++) {
+ const data = await readJson<Page<Preview>>(
+ fetcher,
+ `${base}/workers/workers/${service.result.default_environment.script.tag}/previews?per_page=100&page=${page}`,
+ options.cloudflareToken,
+ );
</file context>
| preview.name === 'staging' || | ||
| (preview.name !== 'main' && branches.has(preview.name)), | ||
| ) | ||
| .flatMap((preview) => preview.urls) |
There was a problem hiding this comment.
P2: A Preview without a routable urls array crashes reconciliation at flatMap, preventing all callback updates. Treat missing URLs as empty with preview.urls ?? [] and model the field as optional.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At scripts/sync-preview-callbacks.ts, line 66:
<comment>A Preview without a routable `urls` array crashes reconciliation at `flatMap`, preventing all callback updates. Treat missing URLs as empty with `preview.urls ?? []` and model the field as optional.</comment>
<file context>
@@ -0,0 +1,110 @@
+ preview.name === 'staging' ||
+ (preview.name !== 'main' && branches.has(preview.name)),
+ )
+ .flatMap((preview) => preview.urls)
+ .map((origin) => new URL('/auth/callback', origin).href),
+ ),
</file context>
| .flatMap((preview) => preview.urls) | |
| .flatMap((preview) => preview.urls ?? []) |
Use HTTP transport to read synthetic data from the fixed staging API, preserving native
fetch's global receiver. Enable Preview sign-in with a dedicated OAuth client, separate from localhost development. The trusted workflow onmainreconciles exact live branch and namedstagingcallbacks after successful Cloudflare builds, branch deletion and hourly cleanup; GitHub Actions OIDC restricts updates to that preview client.Both staging deployments are named Previews under the existing
apiandextensionsWorkers. The directory's existing Cloudflare main build deploys production and thenwrangler preview --name staging, reusing one build. Staging is available at https://staging-extensions.fossbilling.workers.dev, using https://staging-api.fossbilling.workers.dev. Deploy FOSSBilling/auth#81 and configureEXTENSIONS_PREVIEW_CLIENT_IDbefore activating callback reconciliation. FOSSBilling/api#321 keeps the API current and sends staging cache invalidations over HTTP.