[comp] Production Deploy by github-actions[bot] · Pull Request #2904 · trycompai/comp

github-actions · 2026-05-22T00:14:15Z

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

Summary by cubic

Production deploy with safer assistant chat and hardened cloud remediation. Disables OpenAI Responses storage, tightens AWS security‑group validation/normalization (incl. egress GroupId backfill), adds manual‑remediation previews, and strengthens batch remediation with cancellation preservation and conflict‑retry.

New Features
- Assistant Chat: set providerOptions to { openai: { store: false } } for @ai-sdk/openai via ASSISTANT_OPENAI_PROVIDER_OPTIONS.
- Manual remediation: detect [MANUAL] guidance, return guided‑only preview without credentials, and block execute for manual‑only findings.
- Plan normalization: remove S3 ACL steps and s3:PutBucketAcl permissions; backfill EC2 security‑group GroupId from resourceId for ingress/egress across read/fix/rollback.
- AWS validation: AuthorizeSecurityGroupIngress requires GroupId or GroupName; RevokeSecurityGroupIngress requires a rule selector (SecurityGroupRuleIds or rule property params), disallows mixing IDs with properties, requires GroupId/GroupName with properties, and treats empty arrays as missing; improved validation‑error detection.
Refactors
- Trigger tasks: centralized parseApiResponse, classifyExecuteResult, and classifyRetryPreview; used in batch/single/preview to enforce explicit success and surface permission errors.
- Batch remediation: extracted helpers; preserve per‑finding cancellations; retry serializable progress conflicts; recheck cancellations before/after starting a fix; post‑fix rescan via API.
- IAM scan: only flag MFA for users with console access (GetLoginProfile probe); added iam:GetLoginProfile to onboarding script.
- Tests/logs: focused tests for normalizer (incl. egress cases), validators, manual remediation, IAM adapter, API/result classifiers, and batch helpers; minor log/format fixes.

^{Written for commit 10bcf72. Summary will update on new commits. Review in cubic}

fix: harden cloud remediation and chat

vercel · 2026-05-22T00:14:20Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor (staging)	Ready	Preview, Comment	May 22, 2026 1:43am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app (staging)	Skipped		May 22, 2026 1:43am
portal (staging)	Skipped		May 22, 2026 1:43am

cubic-dev-ai

2 issues found across 26 files

Confidence score: 3/5

There is concrete regression risk in apps/api/src/cloud-security/providers/aws/iam.adapter.ts: rethrowing non-NoSuchEntity errors in the console-access probe can abort the MFA scan flow and suppress MFA findings for that run.
apps/api/src/cloud-security/aws-command-executor.ts has a one-of validation bug where SecurityGroupRuleIds may incorrectly be forced to also meet GroupId/GroupName requirements, which can break valid revoke-ingress requests.
Given both issues are medium severity (6/10) with high confidence (8/10) and affect security scanning/command correctness, this is some merge risk rather than a safe-to-merge minor polish change.
Pay close attention to apps/api/src/cloud-security/providers/aws/iam.adapter.ts and apps/api/src/cloud-security/aws-command-executor.ts - scan continuity and revoke-ingress validation logic need careful verification.

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

fix(cloud-tests): harden aws validation paths

tofikwest · 2026-05-22T00:42:39Z

@cubic-dev-ai review it

cubic-dev-ai · 2026-05-22T00:42:49Z

@cubic-dev-ai review it

@tofikwest I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

3 issues found across 26 files

Confidence score: 3/5

There is moderate merge risk because apps/api/src/cloud-security/aws-command-executor.ts allows RevokeSecurityGroupIngress steps to pass validation without a rule selector, which can let invalid revoke actions reach execution paths.
apps/app/src/app/(app)/[orgId]/cloud-tests/actions/batch-fix.ts may call execute for guidedOnly preview results, causing unnecessary requests that are expected to fail for manual-only findings and creating avoidable user-facing errors.
apps/api/src/cloud-security/manual-remediation.ts maps valid 'info' risk to 'medium' in normalizeRisk, which can overstate remediation risk in previews (lower severity, but still behavior-impacting).
Pay close attention to apps/api/src/cloud-security/aws-command-executor.ts, apps/app/src/app/(app)/[orgId]/cloud-tests/actions/batch-fix.ts, apps/api/src/cloud-security/manual-remediation.ts - validation gaps and preview/execution mismatches can produce incorrect or failing remediation flows.

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

…lowup fix(cloud-tests): address release remediation review

tofikwest · 2026-05-22T00:58:57Z

@cubic-dev-ai review it

cubic-dev-ai · 2026-05-22T00:59:04Z

@cubic-dev-ai review it

@tofikwest I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 28 files

Confidence score: 3/5

There is a concrete regression risk in apps/app/src/trigger/tasks/cloud-security/remediate-batch-helpers.ts: persisting the full findings array at each step can overwrite concurrent per-finding cancellation state.
Because this issue is severity 7/10 with high confidence (8/10) and can cause cancelled findings to be processed anyway, this is more than a minor edge case and introduces meaningful user-impacting risk.
Pay close attention to apps/app/src/trigger/tasks/cloud-security/remediate-batch-helpers.ts - concurrent updates to cancellation state may be lost when writing full-array snapshots.

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

fix(cloud-tests): preserve batch finding cancellations

tofikwest · 2026-05-22T01:27:28Z

@cubic-dev-ai review it

cubic-dev-ai · 2026-05-22T01:27:41Z

@cubic-dev-ai review it

@tofikwest I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 29 files

Confidence score: 3/5

There is a concrete regression risk in apps/api/src/cloud-security/plan-normalizer.ts: GroupId backfill currently covers ingress commands but misses egress authorize/revoke operations, which can lead to incomplete or incorrect security-group normalization.
Given the medium severity (6/10) with high confidence (9/10), this is more than a minor edge case and could affect real cloud-security rule updates, so merge risk is moderate.
Pay close attention to apps/api/src/cloud-security/plan-normalizer.ts - egress command handling needs parity with ingress GroupId backfill logic.

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

…alizer fix(cloud-tests): backfill egress security group ids

tofikwest · 2026-05-22T01:46:36Z

@cubic-dev-ai review it

cubic-dev-ai · 2026-05-22T01:46:43Z

@cubic-dev-ai review it

@tofikwest I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 29 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Re-trigger cubic}

claudfuen · 2026-05-22T01:51:39Z

🎉 This PR is included in version 3.62.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

github-actions Bot and others added 4 commits May 21, 2026 23:00

chore: merge release v3.62.0 back to main [skip ci]

e7390ed

fix: harden cloud remediation and chat

af3402d

fix(cloud-tests): address remediation review gaps

eaced08

Merge pull request #2903 from trycompai/tofik/autofix-chat-errors

983ac9a

fix: harden cloud remediation and chat

github-actions Bot added prod-deploy automated-pr labels May 22, 2026

vercel Bot deployed to staging – comp-framework-editor May 22, 2026 00:14 View deployment

vercel Bot deployed to staging – app May 22, 2026 00:16 View deployment

cubic-dev-ai Bot reviewed May 22, 2026

View reviewed changes

Comment thread apps/api/src/cloud-security/providers/aws/iam.adapter.ts Outdated

Comment thread apps/api/src/cloud-security/aws-command-executor.ts Outdated

tofikwest and others added 3 commits May 21, 2026 20:27

fix(cloud-tests): harden aws validation paths

c903201

test(cloud-tests): lint remediation review coverage

5a79bcb

Merge pull request #2905 from trycompai/tofik/remediation-release-review

b17a66c

fix(cloud-tests): harden aws validation paths

vercel Bot temporarily deployed to staging – portal May 22, 2026 00:40 Inactive

vercel Bot temporarily deployed to staging – app May 22, 2026 00:40 Inactive

vercel Bot deployed to staging – comp-framework-editor May 22, 2026 00:41 View deployment

cubic-dev-ai Bot reviewed May 22, 2026

View reviewed changes

Comment thread apps/app/src/app/(app)/[orgId]/cloud-tests/actions/batch-fix.ts

Comment thread apps/api/src/cloud-security/manual-remediation.ts

Comment thread apps/api/src/cloud-security/aws-command-executor.ts

tofikwest and others added 2 commits May 21, 2026 20:54

fix(cloud-tests): address release remediation review

1b3b84a

Merge pull request #2906 from trycompai/tofik/remediation-release-fol…

cc54bf8

…lowup fix(cloud-tests): address release remediation review

vercel Bot temporarily deployed to staging – portal May 22, 2026 00:57 Inactive

vercel Bot deployed to staging – comp-framework-editor May 22, 2026 00:58 View deployment

vercel Bot deployed to staging – app May 22, 2026 01:00 View deployment

cubic-dev-ai Bot reviewed May 22, 2026

View reviewed changes

Comment thread apps/app/src/trigger/tasks/cloud-security/remediate-batch-helpers.ts Outdated

tofikwest and others added 3 commits May 21, 2026 21:09

fix(cloud-tests): preserve batch finding cancellations

ddcf466

fix(cloud-tests): retry batch progress conflicts

199dfc3

Merge pull request #2907 from trycompai/tofik/remediation-batch-cancel

918eff9

fix(cloud-tests): preserve batch finding cancellations

vercel Bot temporarily deployed to staging – portal May 22, 2026 01:21 Inactive

vercel Bot deployed to staging – comp-framework-editor May 22, 2026 01:22 View deployment

vercel Bot deployed to staging – app May 22, 2026 01:25 View deployment

cubic-dev-ai Bot reviewed May 22, 2026

View reviewed changes

Comment thread apps/api/src/cloud-security/plan-normalizer.ts

tofikwest and others added 2 commits May 21, 2026 21:35

fix(cloud-tests): backfill egress security group ids

816ba5c

Merge pull request #2908 from trycompai/tofik/fix-egress-groupid-norm…

10bcf72

…alizer fix(cloud-tests): backfill egress security group ids

vercel Bot temporarily deployed to staging – app May 22, 2026 01:42 Inactive

vercel Bot temporarily deployed to staging – portal May 22, 2026 01:42 Inactive

vercel Bot deployed to staging – comp-framework-editor May 22, 2026 01:43 View deployment

cubic-dev-ai Bot reviewed May 22, 2026

View reviewed changes

tofikwest merged commit 1df3a92 into release May 22, 2026
14 checks passed

claudfuen added the released label May 22, 2026

Conversation

github-actions Bot commented May 22, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

vercel Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

tofikwest commented May 22, 2026

Uh oh!

cubic-dev-ai Bot commented May 22, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tofikwest commented May 22, 2026

Uh oh!

cubic-dev-ai Bot commented May 22, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tofikwest commented May 22, 2026

Uh oh!

cubic-dev-ai Bot commented May 22, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tofikwest commented May 22, 2026

Uh oh!

cubic-dev-ai Bot commented May 22, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

claudfuen commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented May 22, 2026 •

edited by cubic-dev-ai Bot

Loading

vercel Bot commented May 22, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading