This repository was archived by the owner on Jun 19, 2026. It is now read-only.
Repository navigation
ci: bump notify-approval-needed reusable workflow SHA to fix Slack release notifications - #82
Merged
Conversation
…d actions The previously pinned SHA (d2e7c95) of PostHog/.github's notify-approval-needed.yml contained two unpinned action refs (actions/checkout@v6 and PostHog/posthog-github-action@v1.1.1). The ensure-pinned-actions org-level audit check rejects those, so the Slack approval notification never fires on releases — every changeset release sits at the approval gate with maintainers unaware. Bump to current PostHog/.github main (5fc4680), which has those refs SHA-pinned (actions/checkout@de0fac2... # v6.0.2 and posthog-github-action@eea1405... # v1.1.1). Verified at: https://github.com/PostHog/.github/blob/5fc4680761e8ac29a61b212756230eba0e276d8c/.github/workflows/notify-approval-needed.yml
ioannisj
approved these changes
May 26, 2026
ioannisj
left a comment
ioannisj
left a comment
Contributor
There was a problem hiding this comment.
Need to update all slack actions though
3 of 4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Notify Slack - Approval Neededjob in ourReleaseworkflow has been failing silently on every changeset-based release. Symptom: every release sits at theBump version and commit to mainenvironment-protection gate with no Slack notification ever fired, so the client-libraries team has no idea a release is pending approval.First confirmed instance: yesterday's Release run 26473920035 for the
1.6.0release of #81. We had to approve it manually because the auto-notification didn't go out.Root cause
release.ymlline 47 currently calls the org-level reusable workflow at a stale SHA:At that SHA, the reusable workflow contains two unpinned action refs:
actions/checkout@v6(tag, not SHA)PostHog/posthog-github-action@v1.1.1(tag, not SHA)The org-level
ensure-pinned-actionsaudit (introduced into our repo's main ruleset by #80) rejects these, the Slack-notify job fails its checkout step, and no message gets posted.PostHog/.githubhas since fixed these — main today has both refs properly SHA-pinned. We just need to bump the pin.Change
The new SHA is current
PostHog/.github@main. Diff between the two SHAs is just the SHA-pinning of those two action refs; no behavioral changes to the workflow.Verification
Compare the same file at the two SHAs:
Will be verified end-to-end on the next changeset release after this PR merges — the Slack notification should fire.
Other PostHog repos affected by the same stale pin
A quick
gh search codefound four other repos pinning the same stale SHA:PostHog/posthog-flutter—.github/workflows/publish.ymlPostHog/posthog-dotnet—.github/workflows/release.ymlPostHog/posthog-rs—.github/workflows/release.ymlPostHog/mcp-analytics—.github/workflows/release.ymlThey almost certainly have the same broken Slack-notify behavior. Worth a follow-up sweep.
Checklist
If releasing new changes
pnpm changesetto generate a changeset file — N/A, no library changes