Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import { PrDiffStats } from "@posthog/ui/features/inbox/components/PrDiffStats";
import { ReportDetailActions } from "@posthog/ui/features/inbox/components/ReportDetailActions";
import { ReportTasksSection } from "@posthog/ui/features/inbox/components/ReportTasksSection";
import { SuggestedReviewersSection } from "@posthog/ui/features/inbox/components/SuggestedReviewersSection";
import { ReportImplementationPrLink } from "@posthog/ui/features/inbox/components/utils/ReportImplementationPrLink";
import { copyInboxReportLink } from "@posthog/ui/features/inbox/utils/copyInboxReportLink";
import { Text } from "@radix-ui/themes";

Expand Down Expand Up @@ -64,6 +65,10 @@ function PullRequestDetailContent({ report }: { report: SignalReport }) {
report.implementation_pr_url ? (
<>
<InboxMetaSeparator />
<ReportImplementationPrLink
prUrl={report.implementation_pr_url}
size="md"
Comment on lines +68 to +70

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Validate the PR URL before rendering the badge link

This renders ReportImplementationPrLink for any truthy implementation_pr_url, but that field is only typed as an arbitrary string and the tab predicate accepts any truthy value; the existing primary GitHub action is gated by parsePrUrl, while this badge uses the raw value as an external href. If Cloud or a malformed task result sends a non-GitHub URL (or an unsafe scheme), the pull-request detail now exposes a clickable external link that was previously suppressed. Please gate this badge on the parsed GitHub PR URL or sanitize the URL before passing it through.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. The badge now validates the URL with parsePrUrl (the same gate the "Open in GitHub" action uses) and renders nothing when it isn't a canonical GitHub PR URL — so a non-GitHub or unsafe-scheme implementation_pr_url no longer becomes a clickable external link. Shipped in the follow-up #2695.

/>
<PrDiffStats
prUrl={report.implementation_pr_url}
hideWhileLoading
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import { GitMerge, GitPullRequestIcon } from "@phosphor-icons/react";
import { GitMergeIcon, GitPullRequestIcon } from "@phosphor-icons/react";
import { cn } from "@posthog/quill";
import { usePrDetails } from "@posthog/ui/features/git-interaction/usePrDetails";
import { Tooltip } from "@radix-ui/themes";
Expand Down Expand Up @@ -46,26 +46,32 @@ export function ReportImplementationPrLink({
onLinkClick,
}: ReportImplementationPrLinkProps) {
const {
meta: { state, merged, isLoading },
meta: { state, merged, draft, isLoading },
} = usePrDetails(prUrl);

const isSm = size === "sm";

// A draft PR is still `state === "open"` on GitHub, so check `draft` before
// falling through to the open (green) styling.
const colorClass = isLoading
? "bg-gray-4 text-gray-11 hover:bg-gray-5"
: merged
? "bg-violet-4 text-violet-11 hover:bg-violet-5"
: state === "closed"
? "bg-red-4 text-red-11 hover:bg-red-5"
: "bg-green-4 text-green-11 hover:bg-green-5";
: draft
? "bg-gray-4 text-gray-11 hover:bg-gray-5"
: "bg-green-4 text-green-11 hover:bg-green-5";

const { reference: prReference, prNumber } = parseGitHubPrReference(prUrl);

const tooltip = merged
? `Merged – ${prReference}`
: state === "closed"
? `Closed – ${prReference}`
: prReference;
: draft
? `Draft – ${prReference}`
: `Open – ${prReference}`;
Comment on lines 68 to +74

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 The tooltip string is not guarded by isLoading, so while the badge correctly renders gray during a pending fetch, hovering it shows "Open – owner/repo#123" — reflecting default values rather than the actual state. colorClass already has the isLoading guard; applying the same to tooltip keeps both in sync.

Suggested change
const tooltip = merged
? `Merged – ${prReference}`
: state === "closed"
? `Closed – ${prReference}`
: prReference;
: draft
? `Draft – ${prReference}`
: `Open – ${prReference}`;
const tooltip = isLoading
? prReference
: merged
? `Merged – ${prReference}`
: state === "closed"
? `Closed – ${prReference}`
: draft
? `Draft – ${prReference}`
: `Open – ${prReference}`;
Prompt To Fix With AI
This is a comment left during a code review.
Path: packages/ui/src/features/inbox/components/utils/ReportImplementationPrLink.tsx
Line: 68-74

Comment:
The `tooltip` string is not guarded by `isLoading`, so while the badge correctly renders gray during a pending fetch, hovering it shows `"Open – owner/repo#123"` — reflecting default values rather than the actual state. `colorClass` already has the `isLoading` guard; applying the same to `tooltip` keeps both in sync.

```suggestion
  const tooltip = isLoading
    ? prReference
    : merged
      ? `Merged – ${prReference}`
      : state === "closed"
        ? `Closed – ${prReference}`
        : draft
          ? `Draft – ${prReference}`
          : `Open – ${prReference}`;
```

How can I resolve this? If you propose a fix, please make it concise.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — fixed. The tooltip is now guarded by isLoading (it shows just the PR reference while the status is pending), keeping it in sync with colorClass. Since #2694 already merged, this ships in the follow-up #2695 (commit 23c9e0d).

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Treat unknown PR details separately

When git.getPrDetailsByUrl cannot read the PR (for example the GitHub CLI is offline/unauthenticated, the repo is private, or the URL cannot be parsed), the host router returns { state: "unknown", merged: false, draft: false } in packages/host-router/src/routers/git.router.ts:512. This new default branch labels that case as Open (and the color fallback above is green), so the detail page can now show a failed status lookup as a live open PR. Please only render Open for state === "open" and use a neutral/unknown state otherwise.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, and confirmed: getPrDetailsByUrl returns { state: "unknown", merged: false, draft: false } on failure (host-router default), which the badge was painting green/"Open". Fixed — once a lookup settles, the badge renders nothing unless state is one of open/closed/merged, so a failed lookup no longer shows as a live open PR. Shipped in the follow-up #2695 (#2694 had already merged).


const iconSize = isSm ? 10 : 12;

Expand All @@ -88,7 +94,7 @@ export function ReportImplementationPrLink({
)}
>
{merged ? (
<GitMerge size={iconSize} weight="bold" />
<GitMergeIcon size={iconSize} weight="bold" />
) : (
<GitPullRequestIcon size={iconSize} weight="bold" />
)}
Expand Down
Loading