Add gardener workflows by byrichardpowell · Pull Request #7352 · Shopify/cli

byrichardpowell · 2026-04-20T16:43:14Z

Summary

Adds the gardener tooling from shopify-app-js to this monorepo:

gardener-notify-event.yml + gardener-notify-slack.yml — auto-label new issues/PRs with devtools-gardener and post a summary to Slack. Split into two workflows so Dependabot-opened PRs (which lose GITHUB_TOKEN write access and Actions secrets) still get labeled and notified via the workflow_run follow-up.
gardener-investigate-issue.yml — runs anthropics/claude-code-action on issues labeled devtools-investigate-for-gardener. Posts a starter Slack message, runs the investigation against a structured JSON schema, writes the report to the job summary, and threads the Summary section back to Slack.
.agents/skills/investigating-github-issues/ — skill invoked by the workflow, tailored for this monorepo:
- Respects the existing convention of skills living under .agents/skills/ (with .claude/skills symlinked to it).
- Scope is constrained to packages/<pkg>/src/ with a matching .changeset/ entry (Path A fix requires a changeset written directly via the Write tool, not npx changeset).
- Excludes pnpm/npm/npx/nx/tsc from allowed-tools to block arbitrary execution from prompt injection.
- Documents the monorepo layout (cli, cli-kit, app, theme, create-app, the plugin-* family, store, organizations, ui-extensions-*) so the investigation starts in the right package.
- Points at the oclif commands/ → services/ layering and shared cli-kit primitives when tracing bug reports.

Setup required (post-merge)

Create labels: devtools-gardener, devtools-investigate-for-gardener
Add secrets: ANTHROPIC_API_KEY, SLACK_GARDENER_BOT_TOKEN (+ optional ANTHROPIC_BASE_URL)
Add variable: GARDENER_SLACK_CHANNEL_ID

Test plan

Create the devtools-gardener and devtools-investigate-for-gardener labels
Set secrets and variables
Open a throwaway test issue — confirm devtools-gardener is applied and Slack gets a post
Manually apply devtools-investigate-for-gardener to a real issue — confirm the investigation runs and reports back

🤖 Generated with Claude Code

Adds two workflows that react to new issues and PRs: - `gardener-notify-event.yml` captures the triggering payload as an artifact on issue/PR open and on `devtools-gardener` label events. Uses `pull_request_target` so Dependabot- and fork-opened PRs still produce an artifact. - `gardener-notify-slack.yml` runs on `workflow_run` completion, downloads the artifact, applies the `devtools-gardener` label on first open, and posts a summary to Slack. Split into two workflows because Dependabot-triggered workflows lose write permissions and secret access; the `workflow_run` follow-up runs in the default-branch context with full permissions regardless of the upstream actor. Requires a `SLACK_GARDENER_BOT_TOKEN` secret and `GARDENER_SLACK_CHANNEL_ID` variable, plus a `devtools-gardener` label. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds “gardener” automation to the repo to label/notify on new issues & PRs and to run an LLM-assisted investigation workflow for labeled issues, plus the associated agent skill documentation.

Changes:

Introduces a two-step event capture + workflow_run Slack notifier to support Dependabot/fork scenarios.
Adds an issue investigation workflow using anthropics/claude-code-action, posting start/completion updates to Slack and writing results to the job summary.
Adds an investigating-github-issues agent skill and reference templates/policies under .agents/skills/.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/gardener-notify-slack.yml	Downloads captured event payload, applies `devtools-gardener`, and posts an Issue/PR summary to Slack.
.github/workflows/gardener-notify-event.yml	Captures issue/PR webhook payload and uploads it as an artifact for the follow-up notifier.
.github/workflows/gardener-investigate-issue.yml	Runs Claude-based investigations when a label is applied (or via manual dispatch) and posts results to Slack + job summary.
.agents/skills/shared/references/version-maintenance-policy.md	Adds a version-maintenance policy reference used by the investigation skill.
.agents/skills/investigating-github-issues/references/investigation-report-template.md	Adds a structured investigation report template.
.agents/skills/investigating-github-issues/SKILL.md	Adds the investigation skill definition, repository context, and constraints/guardrails.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-20T16:48:27Z

+                  blocks: [{ type: "section", text: { type: "mrkdwn", text: $msg } }] }
+            ' event.json | curl -sf -X POST \
+              -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
+              -H 'Content-type: application/json; charset=utf-8' \
+              -d @- https://slack.com/api/chat.postMessage


curl -f only fails on non-2xx responses; Slack's chat.postMessage often returns HTTP 200 with { "ok": false, ... } for errors (invalid_auth, channel_not_found, etc.). As written, this step can silently succeed even when Slack rejected the message. Consider capturing the response and failing/logging when .ok is false (or use slackapi/slack-github-action, which handles this).

Copilot · 2026-04-20T16:48:28Z

+            NUMBER="${{ github.event.issue.number }}"
+          fi
+          echo "number=$NUMBER" >> "$GITHUB_OUTPUT"
+          echo "url=https://github.com/${{ github.repository }}/issues/$NUMBER" >> "$GITHUB_OUTPUT"


Resolve issue number hardcodes the issue URL to https://github.com/.... This will produce incorrect links on GitHub Enterprise Server and is inconsistent with later use of github.server_url. Consider building the issue URL from github.server_url (and github.repository) instead of hardcoding github.com.

Suggested change

echo "url=https://github.com/${{ github.repository }}/issues/$NUMBER" >> "$GITHUB_OUTPUT"

echo "url=${{ github.server_url }}/${{ github.repository }}/issues/$NUMBER" >> "$GITHUB_OUTPUT"

Copilot · 2026-04-20T16:48:28Z

+      # or no structured_output). Running in github-script so we can parse
+      # the starter response to thread onto it, and use JSON.stringify to
+      # dodge shell-escaping hazards. The report is Claude's trusted
+      # structured output, so no HTML-escape pass.
+      - name: Prepare Slack payload


The Slack payload builder treats Claude's report as "trusted" and skips escaping/sanitization, but the report content is derived from untrusted issue text and can include Slack mrkdwn sequences (e.g., <!channel>, <@U...>, crafted links) that will be interpreted in Slack. Please sanitize/escape the report before placing it in a mrkdwn block (or otherwise neutralize mentions/links) to avoid notification injection/spam.

Copilot · 2026-04-20T16:48:28Z

+            s/</&lt;/g;
+            s/>/&gt;/g;
+            s/\x06/> /g;
+            s{\x01(\d+)\x02(.*?)\x03}{"<$u[$1]|$2>"}ge;


The Markdown→Slack link conversion re-inserts the captured URL into Slack's <url|text> syntax without sanitizing characters like > or |. A crafted Markdown link URL containing these characters can break the Slack markup and potentially inject additional mrkdwn (mentions/links). Consider validating/encoding URLs before interpolation (or avoid converting links and leave them as plain text).

Suggested change

s{\x01(\d+)\x02(.*?)\x03}{"<$u[$1]|$2>"}ge;

s{\x01(\d+)\x02(.*?)\x03}{

my $url = $u[$1];

if ($url !~ /[>|\r\n]/) {

"<$url|$2>";

} else {

$url =~ s/&/&/g;

$url =~ s/</</g;

$url =~ s/>/>/g;

"$2 ($url)";

}

}ge;

Adds a workflow that runs `anthropics/claude-code-action` to investigate GitHub issues in this monorepo, plus the skill it invokes. - `.github/workflows/gardener-investigate-issue.yml` triggers on the `devtools-investigate-for-gardener` label or `workflow_dispatch`. Posts a starter message to Slack, runs the investigation in a structured-output JSON schema, writes the report to the job summary, and posts a threaded follow-up with the Summary section to Slack. - `.agents/skills/investigating-github-issues/` contains the skill and a report template tailored for this monorepo (TypeScript / Node / pnpm / oclif / changesets; scopes edits to `packages/<pkg>/src/` with a matching `.changeset/` entry; points at cli-kit primitives, oclif command/service layout, and the many subpackages merchants might reference). - `.agents/skills/shared/references/version-maintenance-policy.md` is the shared policy referenced by the skill. Skills live under `.agents/skills/` with `.claude/skills -> ../.agents/skills` as the existing convention in this repo. Requires `ANTHROPIC_API_KEY` and `SLACK_GARDENER_BOT_TOKEN` secrets, `GARDENER_SLACK_CHANNEL_ID` variable, and a `devtools-investigate-for-gardener` label. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings April 20, 2026 16:43

byrichardpowell requested a review from a team as a code owner April 20, 2026 16:43

Copilot started reviewing on behalf of byrichardpowell April 20, 2026 16:43 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

ryancbahan approved these changes Apr 20, 2026

View reviewed changes

byrichardpowell force-pushed the add-gardener-workflows branch from 93a2a98 to 72ef4cf Compare April 20, 2026 20:08

byrichardpowell enabled auto-merge April 20, 2026 20:14

byrichardpowell added this pull request to the merge queue Apr 20, 2026

Merged via the queue into main with commit 9c36b1b Apr 20, 2026
25 of 26 checks passed

byrichardpowell deleted the add-gardener-workflows branch April 20, 2026 20:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add gardener workflows#7352

Add gardener workflows#7352
byrichardpowell merged 2 commits intomainfrom
add-gardener-workflows

byrichardpowell commented Apr 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	echo "url=https://github.com/${{ github.repository }}/issues/$NUMBER" >> "$GITHUB_OUTPUT"
	echo "url=${{ github.server_url }}/${{ github.repository }}/issues/$NUMBER" >> "$GITHUB_OUTPUT"

-            s{\x01(\d+)\x02(.*?)\x03}{"<$u[$1]|$2>"}ge;
+            s{\x01(\d+)\x02(.*?)\x03}{
+              my $url = $u[$1];
+              if ($url !~ /[>|\r\n]/) {
+                "<$url|$2>";
+              } else {
+                $url =~ s/&/&amp;/g;
+                $url =~ s/</&lt;/g;
+                $url =~ s/>/&gt;/g;
+                "$2 ($url)";
+              }
+            }ge;

Conversation

byrichardpowell commented Apr 20, 2026

Summary

Setup required (post-merge)

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants