[PR #376] [MERGED] fix(cursor-approve): keep Slack out of the business axis #377

New issue

Closed

opened 2026-10-26 22:39:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:39:11 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/376
Author: @mattmillerai
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @mattmillerai

Base: main ← Head: matt/axis-business-drop-slack

📝 Commits (2)

9d1b0f9 fix(cursor-approve): keep Slack out of the business axis
b251b77 fix(cursor-approve): keep SLACK_TOKEN declared for callers; reject slack in the base

📊 Changes

6 files changed (+45 additions, -17 deletions)

View changed files

📝 .github/cursor-approve/README.md (+2 -1)
📝 .github/cursor-approve/tests/test_context_axes.py (+14 -3)
📝 .github/workflows/axis-business.yml (+9 -5)
📝 .github/workflows/cursor-axis-base.yml (+6 -0)
📝 README.md (+1 -1)
📝 docs/callers/cursor-approve.md (+13 -7)

📄 Description

ELI-5

The business reviewer decides whether a change was actually wanted. One place it looked for that was Slack. Slack is where people argue before they decide, and anyone can post there, so it's a poor record of intent and an easy thing to game or inject into. This PR has the business reviewer use Linear and Notion only.

Change

axis-business.yml: context_sources: linear,notion (it was linear,notion,slack). It no longer forwards SLACK_TOKEN. The secret stays declared as optional and unused, so an existing caller's SLACK_TOKEN: line is not rejected at startup. The header says why.
cursor-axis-base.yml: rejects slack in context_sources, so a direct caller of the public base cannot turn Slack back on either.
docs/callers/cursor-approve.md, README.md and .github/cursor-approve/README.md: drop Slack from the business row, the caller example and the context-axes intro, and add a short "No axis reads Slack" note.
test_context_axes.py: separates declared secrets from forwarded ones, and pins that the base rejects slack and no wrapper enables it.

Why

Not authoritative. Decisions land in a ticket, PRD or TDD. Using a thread as proof that a change was wanted rewards opening a thread just to get a PR approved. It also penalizes work that never had one, such as infra and CI changes.
Injection surface. Anyone in a channel can write text the approver will read while it holds company context.

Compatibility

No caller wires axis-business.yml yet; a search across the org finds only this repo's own references. Even so, SLACK_TOKEN stays declared, so a caller that passes it keeps working. The proxy's slack_search / slack_history and the base's optional SLACK_TOKEN declaration are left in place; removing them can be a separate cleanup.

Provenance

Authored by: agent-work loop
Verified:

python3 -m unittest discover -s .github/cursor-approve/tests -p 'test_*.py': 164 tests OK at head.
check_workflow_pins.py and check_agents_md.py --root .: clean.
PR CI: all checks passing at head.

Deviations:

Review round: kept SLACK_TOKEN declared (unused) instead of removing it, and added the base-level slack rejection.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/376 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/axis-business-drop-slack` --- ### 📝 Commits (2) - [`9d1b0f9`](https://github.com/Comfy-Org/github-workflows/commit/9d1b0f9c45c999379f8d9fa7b6f2eaa821426fdf) fix(cursor-approve): keep Slack out of the business axis - [`b251b77`](https://github.com/Comfy-Org/github-workflows/commit/b251b77b71e12385c326ce9aca3f5d089b39b36d) fix(cursor-approve): keep SLACK_TOKEN declared for callers; reject slack in the base ### 📊 Changes **6 files changed** (+45 additions, -17 deletions) <details> <summary>View changed files</summary> 📝 `.github/cursor-approve/README.md` (+2 -1) 📝 `.github/cursor-approve/tests/test_context_axes.py` (+14 -3) 📝 `.github/workflows/axis-business.yml` (+9 -5) 📝 `.github/workflows/cursor-axis-base.yml` (+6 -0) 📝 `README.md` (+1 -1) 📝 `docs/callers/cursor-approve.md` (+13 -7) </details> ### 📄 Description ## ELI-5 The business reviewer decides whether a change was actually wanted. One place it looked for that was Slack. Slack is where people argue before they decide, and anyone can post there, so it's a poor record of intent and an easy thing to game or inject into. This PR has the business reviewer use Linear and Notion only. ## Change - `axis-business.yml`: `context_sources: linear,notion` (it was `linear,notion,slack`). It no longer forwards `SLACK_TOKEN`. The secret stays declared as optional and unused, so an existing caller's `SLACK_TOKEN:` line is not rejected at startup. The header says why. - `cursor-axis-base.yml`: rejects `slack` in `context_sources`, so a direct caller of the public base cannot turn Slack back on either. - `docs/callers/cursor-approve.md`, `README.md` and `.github/cursor-approve/README.md`: drop Slack from the business row, the caller example and the context-axes intro, and add a short "No axis reads Slack" note. - `test_context_axes.py`: separates declared secrets from forwarded ones, and pins that the base rejects `slack` and no wrapper enables it. ## Why - **Not authoritative.** Decisions land in a ticket, PRD or TDD. Using a thread as proof that a change was wanted rewards opening a thread just to get a PR approved. It also penalizes work that never had one, such as infra and CI changes. - **Injection surface.** Anyone in a channel can write text the approver will read while it holds company context. ## Compatibility No caller wires `axis-business.yml` yet; a search across the org finds only this repo's own references. Even so, `SLACK_TOKEN` stays declared, so a caller that passes it keeps working. The proxy's `slack_search` / `slack_history` and the base's optional `SLACK_TOKEN` declaration are left in place; removing them can be a separate cleanup. ## Provenance **Authored by:** agent-work loop **Verified:** - `python3 -m unittest discover -s .github/cursor-approve/tests -p 'test_*.py'`: 164 tests OK at head. - `check_workflow_pins.py` and `check_agents_md.py --root .`: clean. - PR CI: all checks passing at head. **Deviations:** - Review round: kept `SLACK_TOKEN` declared (unused) instead of removing it, and added the base-level `slack` rejection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-26 22:39:11 +00:00

bsakaguchi referenced this issue

2026-10-26 22:39:11 +00:00

[PR #377] [MERGED] ci: bump cursor-review to github-workflows@c052ff9 #378

bsakaguchi closed this issue

2026-10-26 22:39:11 +00:00