[ascerra]

The ADR Slack notifier displays the PR author under “Merged by”, incorrectly attributing merges. For example, PR #7827 was authored by dhshah13 and merged by waynesun09, but the notification named dhshah13 as the merger.

Use github.event.pull_request.merged_by.login and rename the corresponding environment variable and jq argument so the message identifies the actual merge actor.

Validation: staged-file pre-commit checks passed, including actionlint, YAML validation, pinact, and secret scanning. A local payload check using PR #7827's author/merger verified “Merged by waynesun09”; shell syntax and git diff --check also passed. make is unavailable locally, so its underlying pre-commit run was invoked directly.

[qodo-code-review]

PR Summary by Qodo

Attribute ADR Slack notifications to the PR merger

🐞 Bug fix 🕐 Less than 10 minutes

AI Description

• Show the actual merge actor, rather than the PR author, in ADR Slack notifications.
• Pass the merger’s login through the workflow environment and Slack payload.

Diagram

sequenceDiagram
    participant E as GitHub PR event
    participant W as ADR workflow
    participant J as jq payload
    participant S as Slack webhook
    E->>W: Merged PR and merger login
    W->>J: Pass merger login
    J->>W: Notification payload
    W->>S: Post ADR notification

Loading

High-Level Assessment

Use the pull request event’s merged_by.login field as proposed. It supplies the actor needed by the existing notification path without adding another API call or changing the workflow’s scope.

Files changed (1) +3 / -3

Bug fix (1) +3 / -3

notify-adr-slack.ymlUse the merge actor in ADR Slack messages +3/-3

Use the merge actor in ADR Slack messages

• Replaces the PR author login with merged_by.login and passes it through the environment and jq payload. The “Merged by” line now identifies the person who merged the PR.

.github/workflows/notify-adr-slack.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Slack workflow lacks CI guide sign-off 📘 Rule violation § Compliance

Description

The pull request changes .github/workflows/notify-adr-slack.yml, including its secret-backed Slack
notification step, without stating that docs/contributing/ci-workflows.md was consulted. Because
the workflow runs on pull_request_target and uses secrets, the required guide-consultation
evidence is missing for this change.

Code

.github/workflows/notify-adr-slack.yml[R54-57]

+          PR_MERGED_BY: ${{ github.event.pull_request.merged_by.login }}
          FILE_SUMMARY: ${{ steps.changed.outputs.file_summary }}
        run: |
          if [ -z "$SLACK_WEBHOOK_URL" ]; then

Relevance

● Weak

Nearly identical CI-guide sign-off finding was rejected yesterday for a pull_request_target workflow
using secrets.

PR-#7845

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The checklist requires explicit evidence of consulting docs/contributing/ci-workflows.md whenever
a workflow is changed, especially when pull_request_target and secrets are involved. The changed
workflow contains pull_request_target and secret-backed environment variables, while the supplied
PR description contains no such consultation statement.

Rule 3201588: Consult CI workflow guide when modifying GitHub Actions workflows or secrets
.github/workflows/notify-adr-slack.yml[2-6]
.github/workflows/notify-adr-slack.yml[47-55]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR modifies a GitHub Actions workflow that runs on `pull_request_target` and uses secrets, but the PR description and changed workflow contain no evidence that `docs/contributing/ci-workflows.md` was consulted.

## Fix Focus Areas
- .github/workflows/notify-adr-slack.yml[54-66]

## Recommended Fix
Add an explicit statement to the PR description or an appropriate inline workflow comment confirming that `docs/contributing/ci-workflows.md` was reviewed and that the `pull_request_target`, secret usage, and workflow changes follow its documented conventions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

Context sources

✅ Compliance rules (platform): 72 rules

✅ Skills: writing-user-docs, writing-adrs, check-patch-coverage

✅ Cross-repo context — repo relationships

Review mode: 🚀 Fast: This is a small, localized CI workflow fix that changes only the Slack merger attribution variable and jq argument, with validation already reported.

Tip of the day

💡 Did you know, you can keep summaries lean with Findings visible per group, which tucks the rest behind a View link

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:28 PM UTC · Completed 9:38 PM UTC

Commit: a6e688e · View workflow run →

Runtime: pi · Model: openai/gpt-6.1-sol → gpt-6.1-sol · Effort: high · Cost: $1.62

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Small six-line change touching a protected CI workflow file with low recent churn, warranting a moderate risk score.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/notify-adr-slack.yml — This workflow is under the protected .github/ path. Although the description explains the attribution correction, the PR links no authorizing issue and therefore lacks the required issue-backed justification for modifying governance or infrastructure files. Human approval is always required for protected-path changes.
  Remediation: Link an issue authorizing the workflow correction and obtain human approval for the protected-path change.

---

Labels: The PR corrects attribution in a GitHub Actions notification workflow.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[waynesun09]

Approving the protected-path change.

merged_by is the right source here. The job runs only when merged == true, and for queue merges in this repo merged_by is the human who enqueued (checked on #7827, #7840, #7843 and #7863), so "Merged by" now names that person instead of the author. The value still reaches the script only through env: and jq --arg, so nothing new can be injected, and no references to PR_AUTHOR/$author remain.

Optional, not blocking: merged_by is nullable in the webhook schema. If it were ever null, the message would read "Merged by **". A fallback (merged_by.login || user.login) would cover that.