[comp] Production Deploy by github-actions[bot] · Pull Request #2470 · trycompai/comp

github-actions · 2026-04-07T15:08:38Z

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

…hecks too, not just sync

fix(google-workspace): clarify email filter variable labels apply to sync and checks

cursor · 2026-04-07T15:08:45Z

PR Summary

Medium Risk
Medium risk due to changes to portal session/org switching behavior and email unsubscribe category selection, which can affect access control and notification delivery. Most other changes are low-risk operational/tooling updates (CI runtime pinning, dependency version bumps, and additional task tagging).

Overview
Improves deploy determinism and observability for Trigger.dev jobs. GitHub Actions workflows now pin bun to 1.3.4, and Trigger.dev tasks across API/App add tags.add([org:${organizationId}]) to consistently tag runs by organization.

Fixes a multi-org portal access edge case. Adds an org-scoped layout that ensures the session’s activeOrganizationId is synced to the URL org via a new auth.api.setActiveOrganization call, avoiding 403s for multi-org users.

Includes a few targeted product/runtime tweaks. Evidence upload/validation now allows spreadsheet formats (.csv, .xls, .xlsx) and skips required matrix validation when a companion file is uploaded; task reminder emails now consult the taskReminders unsubscribe setting; Streamdown rendering stops receiving extraneous props; and several dependencies are pinned/bumped (e.g., @browserbasehq/sdk, TipTap, lucide-react).

^{Reviewed by Cursor Bugbot for commit 4650bd9. Bugbot is set up for automated code reviews on this repo. Configure here.}

vercel · 2026-04-07T15:08:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Apr 7, 2026 5:16pm
comp-framework-editor	Ready	Preview, Comment	Apr 7, 2026 5:16pm
portal (staging)	Ready	Preview, Comment	Apr 7, 2026 5:16pm

Customers could only upload PDFs and images when submitting evidence. Added CSV, XLSX, and XLS support to the file type mapper and evidence form definitions (whistleblower-report, tabletop-exercise). Also added an optional spreadsheet upload field to the RBAC matrix form so users can upload their matrix as a file instead of entering rows manually. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…apper - Add matrixFile to rbacMatrixDataSchema with .refine() so the uploaded file isn't silently stripped by Zod - Make matrixRows optional when a companion file is uploaded (both in the Zod schema and the validateRequiredMatrixCells guard) - Add CSV/XLSX/XLS MIME mappings to the step 3 file uploader (four-step forms like tabletop-exercise) which was missed in the prior commit Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

[dev] [Marfuen] mariano/fix-task-reminder-role-notifications

…2468) Multi-org users hitting the portal would get 403s on training completion and other API calls because HybridAuthGuard resolves memberId from the session's activeOrganizationId — which was never updated when the user navigated to a different org in the portal. Adds setActiveOrganization to the portal auth module and a [orgId] layout that syncs the session before any child page renders, matching the pattern already used in the main app. Co-authored-by: Mariano Fuentes <marfuen98@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…lidation The default empty matrix row blocked Zod parsing before the refine could check for a file upload. Switch to superRefine with a lenient base schema that accepts empty strings, then validate non-empty rows strictly only when no file is present. Also fix description text that incorrectly referenced "rows above" when the file field renders first. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Iterate over the original matrixRows array instead of a filtered copy so error paths reference the correct row index in the form UI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…slack packages * chore(deps): update tiptap, lucide-react, electron and remove unused slack packages - @tiptap/*: 3.16.0 → 3.22.1 (all 18 packages aligned across ui, app, framework-editor) - lucide-react: 0.518-0.577 → 1.7.0 (no icon removals affect our usage) - electron: 35.7.5 → 39.8.4 (device-agent) - Remove @slack/bolt and @slack/web-api from integrations (zero imports in codebase) - Fix packages/db prisma.config.ts to load .env via dotenv/config (matches app/portal pattern) All apps build and typecheck successfully. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(deps): upgrade streamdown to v2 for lucide-react v1 compatibility streamdown v1 depends on lucide-react ^0.542.0 which conflicts with our upgrade to lucide-react 1.7.0. streamdown v2 dropped the lucide-react dependency entirely. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ai-elements): fix Streamdown v2 dir prop type incompatibility Stop spreading CollapsibleContent HTML props onto Streamdown which expects dir: "auto" | "ltr" | "rtl" but receives dir: string from the HTML element props. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Mariano Fuentes <marfuen98@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cursor · 2026-04-07T16:28:35Z

apps/portal/src/app/(app)/(home)/[orgId]/layout.tsx

+      headers: requestHeaders,
+      body: { organizationId: orgId },
+    });
+  }


Silent failure of org switch renders children with wrong context

Medium Severity

The setActiveOrganization function silently swallows all errors in production, including network failures and non-OK API responses. This allows [orgId]/layout.tsx to render with a stale activeOrganizationId, leading to 403s or incorrect data from API calls, and making these issues undiagnosable without production logging.

Additional Locations (1)

apps/portal/src/app/lib/auth.ts#L138-L146

^{Reviewed by Cursor Bugbot for commit da7d2d0. Configure here.}

…csv-xlsx fix(documents): allow CSV and Excel file uploads for evidence forms

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 68195a3. Configure here.}

cursor · 2026-04-07T16:45:54Z

apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx

+                                            ];
+                                          }
+                                          if (trimmed === '.xls')
+                                            return ['application/vnd.ms-excel', []];


Duplicated file-type MIME mapping logic across two locations

Low Severity

The new .csv, .xlsx, and .xls extension-to-MIME-type mapping blocks are copy-pasted identically at two separate locations within the same component. This extends an already-duplicated pattern (the existing PDF/PNG/JPG/TXT/SVG/VSDX mappings were also duplicated). Extracting this mapping into a shared helper function would reduce the risk of the two blocks drifting out of sync if future file types are added to only one location.

Additional Locations (1)

apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx#L849-L858

^{Reviewed by Cursor Bugbot for commit 68195a3. Configure here.}

* feat(trigger): add org tags to all trigger job runs Add `await tags.add([`org:${organizationId}`])` to all 25 trigger tasks that receive an organizationId, making it easy to filter and identify which organization a job was run for in the trigger.dev dashboard. Scheduled/bulk tasks that iterate over all orgs are excluded since they don't have a single organizationId. Also updates the vendor extraction prompt to prefer company names over product names (e.g. "Anthropic" not "Claude", "OpenAI" not "ChatGPT"). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(onboarding): prevent duplicate vendors when AI renames product to company The AI now returns an original_name field alongside vendor_name so we can track both "Claude" (user input) and "Anthropic" (canonical name) in the dedup set. Without this, the fallback loop would re-add the product name as a separate vendor. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…#2478) The lockfile was generated with bun 1.3.6 on Vercel but CI was running an older bun via unpinned setup-bun@v2, causing --frozen-lockfile to fail. Pin all trigger workflows to bun 1.3.4 and regenerate the lockfile locally to match. Co-authored-by: Mariano Fuentes <marfuen98@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(ci): pin bun version in trigger workflows and regenerate lockfile The lockfile was generated with bun 1.3.6 on Vercel but CI was running an older bun via unpinned setup-bun@v2, causing --frozen-lockfile to fail. Pin all trigger workflows to bun 1.3.4 and regenerate the lockfile locally to match. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): update packageManager to bun 1.3.4 Aligns the pinned bun version with what CI and developers use, preventing lockfile format mismatches. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(deps): pin @browserbasehq/sdk to 2.6.0 The ^2.5.0/^2.6.0 range resolved to 2.10.0 on Vercel/Docker which has breaking API changes (fingerprint and projectId moved). Pin to 2.6.0 to prevent unexpected upgrades. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Mariano Fuentes <marfuen98@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

claudfuen · 2026-04-07T17:39:59Z

🎉 This PR is included in version 3.17.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

github-actions bot and others added 3 commits April 6, 2026 21:47

chore: merge release v3.16.2 back to main [skip ci]

16d7d99

fix(google-workspace): clarify that email filter variables apply to c…

cb0e6af

…hecks too, not just sync

Merge pull request #2469 from trycompai/fix/gws-variable-labels

ecc04a6

fix(google-workspace): clarify email filter variable labels apply to sync and checks

github-actions bot added prod-deploy automated-pr labels Apr 7, 2026

vercel bot deployed to Preview – comp-framework-editor April 7, 2026 15:08 View deployment

vercel bot deployed to staging – app April 7, 2026 15:09 View deployment

tofikwest and others added 4 commits April 7, 2026 11:24

fix(notifications): dont send task reminders to employees

5a90324

[dev] [Marfuen] mariano/fix-task-reminder-role-notifications

vercel bot temporarily deployed to staging – app April 7, 2026 15:41 Inactive

vercel bot deployed to Preview – comp-framework-editor April 7, 2026 15:42 View deployment

vercel bot deployed to staging – portal April 7, 2026 15:43 View deployment

tofikwest and others added 4 commits April 7, 2026 11:45

Merge branch 'main' into worktree-fix+evidence-upload-csv-xlsx

edababd

fix(documents): use original row index for validation error paths

7ded778

Iterate over the original matrixRows array instead of a filtered copy so error paths reference the correct row index in the form UI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vercel bot deployed to Preview – comp-framework-editor April 7, 2026 16:24 View deployment

Merge branch 'main' into worktree-fix+evidence-upload-csv-xlsx

6511fa1

vercel bot deployed to staging – app April 7, 2026 16:26 View deployment

vercel bot deployed to staging – portal April 7, 2026 16:26 View deployment

fix(documents): fix TS strict index access on matrix row

77d71bd

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cursor bot reviewed Apr 7, 2026

View reviewed changes

Merge pull request #2471 from trycompai/worktree-fix+evidence-upload-…

68195a3

…csv-xlsx fix(documents): allow CSV and Excel file uploads for evidence forms

vercel bot deployed to Preview – comp-framework-editor April 7, 2026 16:42 View deployment

vercel bot deployed to staging – app April 7, 2026 16:44 View deployment

vercel bot deployed to staging – portal April 7, 2026 16:44 View deployment

cursor bot reviewed Apr 7, 2026

View reviewed changes

vercel bot temporarily deployed to staging – portal April 7, 2026 17:00 Inactive

vercel bot deployed to Preview – comp-framework-editor April 7, 2026 17:01 View deployment

vercel bot deployed to staging – app April 7, 2026 17:03 View deployment

vercel bot had a problem deploying to staging – app April 7, 2026 17:09 Failure

vercel bot deployed to staging – portal April 7, 2026 17:10 View deployment

vercel bot deployed to Preview – comp-framework-editor April 7, 2026 17:12 View deployment

vercel bot deployed to Preview – comp-framework-editor April 7, 2026 17:15 View deployment

vercel bot deployed to staging – portal April 7, 2026 17:16 View deployment

vercel bot deployed to staging – app April 7, 2026 17:16 View deployment

Marfuen merged commit 596f2ef into release Apr 7, 2026
13 checks passed

claudfuen added the released label Apr 7, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[comp] Production Deploy#2470

[comp] Production Deploy#2470
Marfuen merged 17 commits intoreleasefrom
main

github-actions bot commented Apr 7, 2026

Uh oh!

cursor bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

vercel bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

cursor bot Apr 7, 2026

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Apr 7, 2026

Uh oh!

Uh oh!

claudfuen commented Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

github-actions bot commented Apr 7, 2026

Uh oh!

cursor bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

vercel bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot Apr 7, 2026

Choose a reason for hiding this comment

Silent failure of org switch renders children with wrong context

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Apr 7, 2026

Choose a reason for hiding this comment

Duplicated file-type MIME mapping logic across two locations

Uh oh!

Uh oh!

claudfuen commented Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cursor bot commented Apr 7, 2026 •

edited

Loading

vercel bot commented Apr 7, 2026 •

edited

Loading