Codestin Search App

felipefreitag · 2026-03-04T17:13:46Z

No description provided.

pkg-pr-new · 2026-03-04T17:14:47Z

npm i https://pkg.pr.new/resend@866

commit: 7ef5d29

cubic-dev-ai

4 issues found across 25 files

Confidence score: 3/5

There’s some meaningful merge risk: src/events/events.spec.ts adds new Resend Events/workflow SDK operations without explicit confirmation of required production API-key permissions, which can lead to authorization failures or policy non-compliance after release.
src/workflows/workflows.spec.ts and src/events/events.spec.ts include API-key-like hardcoded token strings in tests; even in test artifacts, this is a security hygiene concern and should be replaced with redacted placeholders before merging.
In src/events/events.spec.ts, a test retrieves data without asserting it, so regressions in events.get response handling may slip through undetected.
Pay close attention to src/events/events.spec.ts and src/workflows/workflows.spec.ts - permission-check compliance and token redaction need to be resolved to reduce risk.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/events/events.spec.ts">

<violation number="1" location="src/events/events.spec.ts:15">
P2: Avoid committing raw API tokens in tests; use a redacted placeholder value instead.

(Based on your team's feedback about redacting secrets from test artifacts.) [FEEDBACK_USED]</violation>

<violation number="2" location="src/events/events.spec.ts:131">
P1: Custom agent: **API Key Permission Check SDK Methods**

Rule 1 (API Key Permission Check SDK Methods) is violated: this PR introduces new Resend Events/workflow SDK operations without an explicit confirmation that production API keys have the required permissions for these endpoints. Add a permission-scope verification note/check before release to avoid runtime authorization failures.</violation>

<violation number="3" location="src/events/events.spec.ts:257">
P2: The test fetches `data` but never asserts it, so regressions in `events.get` response handling can pass unnoticed.</violation>
</file>

<file name="src/workflows/workflows.spec.ts">

<violation number="1" location="src/workflows/workflows.spec.ts:17">
P2: Do not commit API-key-like secrets in test code; replace hardcoded token strings with a redacted dummy/test value.

(Based on your team's feedback about redacting secrets from test artifacts.) [FEEDBACK_USED]</violation>
</file>

Since this is your first cubic review, here's how it works:

cubic automatically reviews your code and comments on bugs and improvements
Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
Add one-off context when rerunning by tagging @cubic-dev-ai with guidance or docs links (including llms.txt)
Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai

2 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/workflow-runs/workflow-runs.spec.ts">

<violation number="1" location="src/workflow-runs/workflow-runs.spec.ts:41">
P2: Avoid hardcoding token-like API keys in tests; use an obviously redacted/dummy value instead.

(Based on your team's feedback about redacting secrets in test artifacts.) [FEEDBACK_USED]</violation>
</file>

<file name="src/workflow-runs/workflow-runs.ts">

<violation number="1" location="src/workflow-runs/workflow-runs.ts:18">
P1: Custom agent: **API Key Permission Check SDK Methods**

This PR adds new Workflow Runs SDK operations (`get`/`list`) but does not include a permission-check reminder/handling path for API keys. Per the API Key Permission Check SDK Methods rule, confirm production API keys have scopes for these new `/workflows/*/runs` operations to prevent permission-related runtime failures.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai

2 issues found across 10 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/workflow-run-steps/workflow-run-steps.ts">

<violation number="1" location="src/workflow-run-steps/workflow-run-steps.ts:21">
P1: Custom agent: **API Key Permission Check SDK Methods**

This PR adds new SDK methods that call workflow run step endpoints. Please confirm that the existing production API keys are provisioned with the required permissions for these new workflow run step read operations to avoid permission failures after deployment.</violation>
</file>

<file name="src/workflow-run-steps/workflow-run-steps.spec.ts">

<violation number="1" location="src/workflow-run-steps/workflow-run-steps.spec.ts:46">
P2: Avoid hardcoding API keys in test code; use a redacted placeholder or environment variable to prevent credential leakage.

(Based on your team's feedback about redacting secrets from test recordings/cassettes even if ephemeral.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/workflows/interfaces/workflow-step.interface.ts">

<violation number="1" location="src/workflows/interfaces/workflow-step.interface.ts:82">
P3: `WorkflowStepType` duplicates the literal step-type list already defined by `WorkflowStep`, creating a drift risk. Derive it from `WorkflowStep['type']` to keep a single source of truth.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai

7 issues found across 30 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/automations/automations.spec.ts">

<violation number="1" location="src/automations/automations.spec.ts:17">
P2: Do not hardcode API key values in tests; use a redacted placeholder or environment-driven test key instead.

(Based on your team's feedback about redacting secrets from test artifacts.) [FEEDBACK_USED]</violation>

<violation number="2" location="src/automations/automations.spec.ts:54">
P1: Custom agent: **API Key Permission Check SDK Methods**

Confirm production Resend API keys have permissions for the new Automations operations (create/list/get/remove/update). This PR introduces new SDK method usage, so keys without automations scope will fail at runtime.</violation>
</file>

<file name="src/automation-runs/automation-runs.spec.ts">

<violation number="1" location="src/automation-runs/automation-runs.spec.ts:43">
P2: Redact the API key in tests and use a placeholder or env-provided value instead.

(Based on your team's feedback about redacting secrets from test recordings/cassettes even if keys are ephemeral.) [FEEDBACK_USED]</violation>

<violation number="2" location="src/automation-runs/automation-runs.spec.ts:45">
P1: Custom agent: **API Key Permission Check SDK Methods**

The new Resend SDK methods for automation run get/list require confirming production API keys include the necessary permissions for automation run read/list operations, per the API Key Permission Check rule.</violation>
</file>

<file name="src/automation-run-steps/automation-run-steps.spec.ts">

<violation number="1" location="src/automation-run-steps/automation-run-steps.spec.ts:43">
P2: Redact the API key literal in tests; use a non-secret dummy value instead.

(Based on your team's feedback about redacting secrets.) [FEEDBACK_USED]</violation>
</file>

<file name="src/common/utils/parse-automation-to-api-options.spec.ts">

<violation number="1" location="src/common/utils/parse-automation-to-api-options.spec.ts:11">
P2: The test input `name` no longer matches the expected output `name`, causing this spec to fail.</violation>
</file>

<file name="src/automation-run-steps/automation-run-steps.ts">

<violation number="1" location="src/automation-run-steps/automation-run-steps.ts:21">
P2: Custom agent: **API Key Permission Check SDK Methods**

Confirm production API keys have permission to access the new automation run steps endpoints (get/list). The rule requires this check for newly introduced SDK methods to avoid permission failures after deployment.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-03-25T20:06:11Z

+
+    const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop');
+    await expect(
+      resend.automations.runs.get(options),


P1: Custom agent: API Key Permission Check SDK Methods

The new Resend SDK methods for automation run get/list require confirming production API keys include the necessary permissions for automation run read/list operations, per the API Key Permission Check rule.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/automation-runs/automation-runs.spec.ts, line 45: <comment>The new Resend SDK methods for automation run get/list require confirming production API keys include the necessary permissions for automation run read/list operations, per the API Key Permission Check rule.</comment> <file context> @@ -0,0 +1,202 @@ + + const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop'); + await expect( + resend.automations.runs.get(options), + ).resolves.toMatchInlineSnapshot(` + { </file context>

cubic-dev-ai

1 issue found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/workflow-run-steps/workflow-run-steps.ts">

<violation number="1" location="src/workflow-run-steps/workflow-run-steps.ts:21">
P1: Custom agent: **API Key Permission Check SDK Methods**

This change introduces calls to the Resend `/automations` endpoints, which are new provider operations. Confirm production API keys have the required permissions for automation workflow runs to avoid permission failures after deployment.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

Co-authored-by: Cursor Agent <[email protected]>

cubic-dev-ai · 2026-04-09T12:54:08Z

You're iterating quickly on this pull request. To help protect your rate limits, cubic has paused automatic reviews on new pushes for now—when you're ready for another review, comment @cubic-dev-ai review.

…API (#915) Co-authored-by: Cursor Agent <[email protected]>

zenorocha · 2026-04-10T22:26:08Z

@cubic-dev-ai review

cubic-dev-ai · 2026-04-10T22:26:18Z

@cubic-dev-ai review

@zenorocha I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

2 issues found across 16 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/automation-runs/automation-runs.ts">

<violation number="1" location="src/automation-runs/automation-runs.ts:32">
P2: Avoid setting `status` when it is an empty array; the current truthy check serializes `[]` as `status=`.</violation>
</file>

<file name="src/automations/automations.ts">

<violation number="1" location="src/automations/automations.ts:114">
P1: Custom agent: **API Key Permission Check SDK Methods**

New provider SDK operation (`automations stop`) was introduced without confirming production API key permissions for this action. Add an explicit permission check/reminder for rollout to prevent post-deploy authorization failures.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-04-10T22:29:05Z

+    if (options.status) {
+      const statusValue = Array.isArray(options.status)
+        ? options.status.join(',')
+        : options.status;
+      searchParams.set('status', statusValue);
+    }


P2: Avoid setting status when it is an empty array; the current truthy check serializes [] as status=.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/automation-runs/automation-runs.ts, line 32: <comment>Avoid setting `status` when it is an empty array; the current truthy check serializes `[]` as `status=`.</comment> <file context> @@ -27,8 +27,18 @@ export class AutomationRuns { - ? `/automations/${options.automationId}/runs?${queryString}` + const searchParams = new URLSearchParams(queryString); + + if (options.status) { + const statusValue = Array.isArray(options.status) + ? options.status.join(',') </file context>

Suggested change

if (options.status) {

const statusValue = Array.isArray(options.status)

? options.status.join(',')

: options.status;

searchParams.set('status', statusValue);

}

if (

options.status !== undefined &&

(!Array.isArray(options.status) || options.status.length > 0)

) {

const statusValue = Array.isArray(options.status)

? options.status.join(',')

: options.status;

searchParams.set('status', statusValue);

}

felipefreitag requested a review from a team as a code owner March 4, 2026 17:13

felipefreitag requested a review from vcapretz March 4, 2026 17:13

felipefreitag changed the title ~~feat: Preview workflows~~ feat: preview workflows Mar 4, 2026

cubic-dev-ai Bot reviewed Mar 4, 2026

View reviewed changes

Comment thread src/events/events.spec.ts

Comment thread src/workflows/workflows.spec.ts Outdated

Comment thread src/events/events.spec.ts

Comment thread src/events/events.spec.ts Outdated

felipefreitag closed this Mar 4, 2026

felipefreitag reopened this Mar 4, 2026

felipefreitag added the do not merge label Mar 4, 2026

cubic-dev-ai Bot reviewed Mar 5, 2026

View reviewed changes

Comment thread src/workflow-runs/workflow-runs.ts Outdated

Comment thread src/workflow-runs/workflow-runs.spec.ts Outdated

cubic-dev-ai Bot reviewed Mar 5, 2026

View reviewed changes

Comment thread src/workflow-run-steps/workflow-run-steps.ts Outdated

Comment thread src/workflow-run-steps/workflow-run-steps.spec.ts Outdated

cubic-dev-ai Bot reviewed Mar 6, 2026

View reviewed changes

Comment thread src/workflows/interfaces/workflow-step.interface.ts Outdated

vcapretz force-pushed the preview-workflows branch from fbcd35d to fe596d9 Compare March 25, 2026 19:32

cubic-dev-ai Bot reviewed Mar 25, 2026

View reviewed changes

Comment thread src/workflow-run-steps/workflow-run-steps.ts Outdated

felipefreitag added 16 commits April 9, 2026 09:48

feat: workflows

945c9b4

chore: bump version

959561e

feat: add events and patch workflow

610ca1f

fix: update workflow create response

41ea962

fix: update event schema validation

51494bd

fix: linter

dfcf123

fix: update types

c35348c

feat: add workflow runs list and details

c77997b

feat: add workflow run steps

ebfd3d9

fix: remove implementation details

2a52217

feat: add steps payload

3c18f09

feat: improve workflow types

37bdf58

chore: bump package

c95c1cd

fix:lint

6044ed9

fix: types

14f96ea

fix: remove type repetition

c02d756

felipefreitag and others added 7 commits April 9, 2026 09:50

fix: lint

74abc72

move to automations

8ee5942

use automations endpoint

ae6d889

chore: bump package version

2b845bd

feat: remove workflows namespace from SDK (#898)

19e5642

Co-authored-by: Cursor Agent <[email protected]>

fix send event

a1799f9

new version

1e57f4f

vcapretz force-pushed the preview-workflows branch from 3e2d00f to 1e57f4f Compare April 9, 2026 12:50

new version

2096c66

vcapretz and others added 7 commits April 9, 2026 12:32

chore: remove automation-run-steps endpoints that don't exist in the …

b21dd33

…API (#915) Co-authored-by: Cursor Agent <[email protected]>

ref to key

027ee94

feat: update code to correspond to automation API changes (#917)

3ab7349

refactor: edge type (#919)

2455ebf

refactor: rename edges (#920)

d8fbb20

chore: automations breaking changes (#918)

ab25d1f

chore: bump version (#923)

e145638

zenorocha approved these changes Apr 10, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Apr 10, 2026

View reviewed changes

zenorocha changed the title ~~feat: preview workflows~~ feat: add automations and events Apr 10, 2026

fix: template object structure (#924)

7ef5d29

zenorocha merged commit 86d807d into canary Apr 10, 2026
12 checks passed

zenorocha deleted the preview-workflows branch April 10, 2026 22:48

zenorocha removed the do not merge label Apr 10, 2026

Conversation

felipefreitag commented Mar 4, 2026

Uh oh!

pkg-pr-new Bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot commented Apr 9, 2026

Uh oh!

zenorocha commented Apr 10, 2026

Uh oh!

cubic-dev-ai Bot commented Apr 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

pkg-pr-new Bot commented Mar 4, 2026 •

edited

Loading