Import Fathom recording media asynchronously #22533

Workflow file for this run

.github/workflows/ci-e2e-main.yaml at e8d5de2

	name: CI E2E Main

	on:
	push:
	branches: [main]

	pull_request:
	types: [labeled, synchronize, opened, reopened]

	# Manual QA Scout run against an already-merged PR (executes on main).
	workflow_dispatch:
	inputs:
	pr_number:
	description: "Merged PR number for the QA Scout (defaults to the PR of the latest main commit)"
	required: false

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

	jobs:
	e2e-test:
	if: >
	github.event_name == 'push' \|\|
	github.event_name == 'workflow_dispatch' \|\|
	(github.event_name == 'pull_request' &&
	contains(github.event.pull_request.labels.*.name, 'qa-scout')) \|\|
	(github.event_name == 'pull_request' &&
	contains(github.event.pull_request.labels.*.name, 'run-merge-queue'))
	runs-on: ubuntu-latest-8-cores
	# 60 so build + suite plus the QA Scout's 15-minute step cap cannot hit
	# the job ceiling: a job timeout overrides step continue-on-error and
	# would redden the status check.
	timeout-minutes: 60
	outputs:
	qa-scout-run: ${{ steps.qa-scout-pr.outputs.run }}
	qa-scout-pr-number: ${{ steps.qa-scout-pr.outputs.pr_number }}
	env:
	NODE_OPTIONS: "--max-old-space-size=10240"
	services:
	postgres:
	image: postgres:18
	env:
	POSTGRES_USER: postgres
	POSTGRES_PASSWORD: postgres
	ports:
	- 5432:5432
	options: >-
	--health-cmd pg_isready
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5
	redis:
	image: redis
	ports:
	- 6379:6379
	steps:
	# Audit only: records every outbound endpoint this job touches in the
	# StepSecurity insights, blocks nothing, changes no behavior. This is
	# the observation phase for the QA Scout containment follow-up: the
	# agent step's allowlist scopes what it does, not where the runner can
	# reach, so once the job's endpoint set is known and stable from a few
	# weeks of audit data, egress-policy block with that allowlist makes
	# real-time exfiltration impossible rather than merely unscoped.
	- name: Harden runner (egress audit)
	# Fail-open while auditing: an observer must never redden the status
	# check. The eventual block-mode flip drops this so it fails closed.
	continue-on-error: true
	uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
	with:
	egress-policy: audit

	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	fetch-depth: 10

	- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
	with:
	node-version: lts/*

	- name: Install dependencies
	uses: ./.github/actions/yarn-install

	- name: Restore Nx build cache
	uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (restore)
	with:
	key: v4-e2e-build-${{ github.ref_name }}-${{ github.sha }}
	restore-keys: \|
	v4-e2e-build-${{ github.ref_name }}-
	v4-e2e-build-main-
	path: \|
	.nx
	node_modules/.cache
	packages/*/node_modules/.cache

	- name: Build twenty-shared
	run: npx nx build twenty-shared

	- name: Install Playwright Browsers
	run: npx nx setup twenty-e2e-testing

	- name: Setup environment files
	run: \|
	cp packages/twenty-front/.env.example packages/twenty-front/.env
	npx nx reset:env:e2e-testing-server twenty-server

	- name: Build frontend
	run: NODE_ENV=production npx nx build twenty-front

	- name: Build server
	run: npx nx build twenty-server

	- name: Save Nx build cache
	if: always()
	uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (save)
	with:
	key: v4-e2e-build-${{ github.ref_name }}-${{ github.sha }}
	path: \|
	.nx
	node_modules/.cache
	packages/*/node_modules/.cache

	- name: Create and setup database
	run: \|
	PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
	PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
	npx nx run twenty-server:database:reset

	# Cookie sessions are credentialed, so the front only authenticates from
	# the API's own origin, workspace subdomains included.
	- name: Serve the frontend from the server
	run: cp -r packages/twenty-front/build packages/twenty-server/dist/front

	# Logs are teed to files so the QA Scout can diff its own log window; the
	# console output is unchanged.
	- name: Start server
	run: \|
	mkdir -p /tmp/qa-scout
	npx nx run twenty-server:start:ci 2>&1 \| tee /tmp/qa-scout/server.log &
	echo "Waiting for server to be ready..."
	timeout 120 bash -c 'until curl -sf http://localhost:3000/healthz > /dev/null; do sleep 2; done'

	- name: Start worker
	run: \|
	npx nx run twenty-server:worker 2>&1 \| tee /tmp/qa-scout/worker.log &
	echo "Worker started"

	- name: Run Playwright tests
	env:
	FRONTEND_BASE_URL: http://localhost:3000
	run: npx nx test twenty-e2e-testing

	- name: Upload Playwright results
	if: always()
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
	with:
	name: playwright-results
	path: \|
	packages/twenty-e2e-testing/run_results/
	packages/twenty-e2e-testing/test-results/
	retention-days: 7

	# ── QA Scout ─────────────────────────────────────────────────────────
	# Post-merge browser QA agent (.claude/skills/qa-scout/SKILL.md): scopes
	# scenarios from the merged PR's diff, drives the already-running app,
	# watches server/worker logs, and writes a verdict. Shadow-safe: every
	# step is continue-on-error so the Scout can never redden main CI. Runs
	# after the deterministic suite even when it failed (a broken main is
	# exactly when a loud report helps), but not on merge-queue PR runs.
	- name: QA Scout / Prepare merged PR context
	id: qa-scout-pr
	if: >-
	${{ !cancelled() && (
	github.event_name == 'push' \|\|
	github.event_name == 'workflow_dispatch' \|\|
	(github.event_name == 'pull_request' &&
	contains(github.event.pull_request.labels.*.name, 'qa-scout') &&
	github.event.pull_request.head.repo.full_name == github.repository)
	) }}
	continue-on-error: true
	env:
	GH_TOKEN: ${{ github.token }}
	INPUT_PR_NUMBER: ${{ github.event.inputs.pr_number }}
	EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
	run: \|
	set -euo pipefail
	mkdir -p /tmp/qa-scout/context /tmp/qa-scout/output /tmp/qa-scout/browser
	MODE="post-merge"
	if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
	# Label-triggered pre-merge validation: the checkout IS the PR
	# head, so the Scout QAs the PR itself before it merges.
	MODE="pre-merge"
	PR_NUMBER="${EVENT_PR_NUMBER:-}"
	else
	PR_NUMBER="${INPUT_PR_NUMBER:-}"
	if [ -z "$PR_NUMBER" ]; then
	PR_NUMBER=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls" --jq '.[0].number // empty' \|\| true)
	fi
	fi
	if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
	echo "No target PR resolved; skipping QA Scout."
	echo "run=false" >> "$GITHUB_OUTPUT"
	exit 0
	fi
	gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
	--json number,title,body,author,url,mergedAt > /tmp/qa-scout/context/pr.json
	# The post-merge Scout QAs main, so an unmerged PR (reachable via
	# manual dispatch) would get a verdict about code main does not
	# contain. Pre-merge label runs check out the PR head, so the guard
	# does not apply there.
	if [ "$MODE" = "post-merge" ] && [ -z "$(jq -r '.mergedAt // empty' /tmp/qa-scout/context/pr.json)" ]; then
	echo "PR #${PR_NUMBER} is not merged; skipping QA Scout."
	echo "run=false" >> "$GITHUB_OUTPUT"
	exit 0
	fi
	printf '%s\n' "$MODE" > /tmp/qa-scout/context/mode
	TITLE=$(jq -r '.title' /tmp/qa-scout/context/pr.json)
	# Mirrors mustBeQa in the eng app: [no-qa]/[noqa] escape hatch, i18n
	# translation PRs are auto-generated and never QA candidates.
	LOWER=$(printf '%s' "$TITLE" \| tr '[:upper:]' '[:lower:]')
	case "$LOWER" in
	"[no-qa]" \| "[noqa]")
	echo "Skipping QA Scout: [no-qa] in PR title."
	echo "run=false" >> "$GITHUB_OUTPUT"
	exit 0
	;;
	i18ntranslation)
	echo "Skipping QA Scout: i18n translation PR."
	echo "run=false" >> "$GITHUB_OUTPUT"
	exit 0
	;;
	esac
	# gh rejects --slurp together with --jq, so aggregate the per-page
	# jq output with a local jq instead.
	gh api --paginate "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files?per_page=100" \
	--jq '.[] \| {path: .filename, additions, deletions, status}' \
	\| jq -s '.' > /tmp/qa-scout/context/files.json
	gh pr diff "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" > /tmp/qa-scout/full.diff
	DIFF_BYTES=$(wc -c < /tmp/qa-scout/full.diff)
	head -c 2000000 /tmp/qa-scout/full.diff > /tmp/qa-scout/context/pr.diff
	if [ "$DIFF_BYTES" -gt 2000000 ]; then
	printf '\n[pr.diff truncated: 2000000 of %s bytes shown; files.json is complete]\n' "$DIFF_BYTES" >> /tmp/qa-scout/context/pr.diff
	fi
	rm /tmp/qa-scout/full.diff
	cat > /tmp/qa-scout/mcp.json <<'EOF'
	{
	"mcpServers": {
	"playwright": {
	"command": "npx",
	"args": [
	"-y",
	"@playwright/mcp@0.0.79",
	"--headless",
	"--browser", "chrome",
	"--isolated",
	"--output-dir", "/tmp/qa-scout/browser",
	"--allowed-origins", "http://localhost:3000;http://127.0.0.1:3000;http://app.localhost:3000;http://apple.localhost:3000"
	]
	}
	}
	}
	EOF
	echo "run=true" >> "$GITHUB_OUTPUT"
	echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"

	# The Scout invokes the Claude Code CLI directly rather than through
	# claude-code-action: the action rejects push events outright
	# ("Unsupported event type: push", still true at its latest version),
	# which silently killed the post-merge mode this Scout exists for, and
	# its GitHub bootstrap was the only reason a GitHub token entered this
	# step at all. Direct invocation runs on every trigger and leaves the
	# agent holding no GitHub credential whatsoever; the PR comment is
	# posted by the qa-scout-comment job from the uploaded verdict, so
	# untrusted page/log content can never reach a privileged credential.
	# The Bash allowlist scopes the agent to its task; it is not the
	# containment boundary (psql alone is arbitrarily powerful in this
	# disposable env). Containment is the absence of credentials beyond
	# inference, the scrub step, and Actions secret masking on the token.
	- name: QA Scout / Run
	id: qa-scout-run
	if: ${{ !cancelled() && steps.qa-scout-pr.outputs.run == 'true' }}
	continue-on-error: true
	timeout-minutes: 15
	env:
	CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
	PGPASSWORD: postgres
	run: \|
	set -euo pipefail
	npm install -g @anthropic-ai/claude-code@2.1.247
	# stream-json teed into the artifact tree, ahead of the scrub,
	# keeps per-turn detail and permission denials so allowlist tuning
	# reads real data. stderr and the exit code are kept too: a run that
	# never reaches a result line (bad flag, exhausted quota) explains
	# itself only there, and the summary step reads both back.
	set +e
	claude -p "Read .claude/skills/qa-scout/SKILL.md and follow it exactly. This is the CI invocation: every path and credential in the skill's Inputs table applies verbatim." \
	--max-turns 150 \
	--model opus \
	--add-dir /tmp/qa-scout \
	--strict-mcp-config \
	--mcp-config /tmp/qa-scout/mcp.json \
	--allowedTools "Read,Grep,Glob,Write,TodoWrite,Bash(cat ),Bash(tail ),Bash(head ),Bash(wc ),Bash(ls ),Bash(grep ),Bash(jq ),Bash(echo ),Bash(diff ),Bash(sort ),Bash(uniq ),Bash(cut ),Bash(tr ),Bash(mkdir ),Bash(sleep ),Bash(date ),Bash(psql *),mcp__playwright" \
	--output-format stream-json --verbose \
	2> >(tee /tmp/qa-scout/agent-stderr.log >&2) \
	\| tee /tmp/qa-scout/execution.json
	AGENT_EXIT=${PIPESTATUS[0]}
	set -e
	printf '%s' "$AGENT_EXIT" > /tmp/qa-scout/agent-exit.txt
	exit "$AGENT_EXIT"

	# The agent process necessarily holds the inference credential, and a
	# prompt-injected agent could copy it into any file it can write. The
	# artifact ships the whole /tmp/qa-scout tree (context, browser output,
	# logs, report), so redact Anthropic token shapes across all of it, in
	# the trusted lane, before anything is published.
	- name: QA Scout / Scrub outputs
	if: ${{ !cancelled() && steps.qa-scout-pr.outputs.run == 'true' }}
	continue-on-error: true
	run: \|
	set -euo pipefail
	# NUL-delimited paths and no -I: an agent-chosen filename with
	# spaces or newlines, or a token tucked into a binary-looking file,
	# must not escape redaction.
	if grep -rq 'sk-ant-' /tmp/qa-scout 2>/dev/null; then
	echo "Redacting Anthropic token shapes from Scout files:"
	grep -rl 'sk-ant-' /tmp/qa-scout 2>/dev/null
	grep -rlZ 'sk-ant-' /tmp/qa-scout 2>/dev/null \
	\| xargs -0 sed -i -E 's/sk-ant-[A-Za-z0-9_-]+/[REDACTED]/g'
	fi

	# Always leaves a breadcrumb on push/dispatch runs so a broken prepare
	# step can never disable the Scout silently.
	- name: QA Scout / Job summary
	if: ${{ !cancelled() && steps.qa-scout-pr.outcome != 'skipped' }}
	continue-on-error: true
	env:
	SCOUT_RUN: ${{ steps.qa-scout-pr.outputs.run }}
	SCOUT_PREP_OUTCOME: ${{ steps.qa-scout-pr.outcome }}
	run: \|
	# Why the run ended, from the evidence the agent leaves behind: the
	# final stream-json result when it produced one, stderr when it died
	# before that. Without this the summary can only say "no report".
	scout_failure_reason() {
	local result_line exit_code
	exit_code=$(cat /tmp/qa-scout/agent-exit.txt 2>/dev/null \|\| echo "unknown")
	echo "Why it stopped (exit code \`${exit_code}\`)"
	echo ""
	result_line=$(grep -a '"type":"result"' /tmp/qa-scout/execution.json 2>/dev/null \| tail -1 \|\| true)
	if [ -n "$result_line" ]; then
	printf '%s' "$result_line" \| jq -r '
	"- outcome: `\(.subtype // "unknown")`" +
	" · \(.num_turns // "?") turns" +
	" · \(((.duration_ms // 0) / 60000 * 10 \| round) / 10) min" +
	" · $\(((.total_cost_usd // 0) * 100 \| round) / 100)",
	(if ((.errors? // []) \| length) > 0 then "- error: " + ((.errors \| join("; "))) else empty end)
	' 2>/dev/null \|\| echo "- the final result line could not be parsed; see the artifact"
	else
	echo "- the agent produced no result line, so it failed before or during startup"
	fi
	if [ -s /tmp/qa-scout/agent-stderr.log ]; then
	echo ""
	echo "<details><summary>stderr (last 10 lines)</summary>"
	echo ""
	echo '```'
	tail -n 10 /tmp/qa-scout/agent-stderr.log
	echo '```'
	echo ""
	echo "</details>"
	fi
	}
	{
	echo "## QA Scout"
	if [ -f /tmp/qa-scout/output/report.md ]; then
	if [ "$(jq -r '.status // "final"' /tmp/qa-scout/output/verdict.json 2>/dev/null \|\| echo final)" != "final" ]; then
	echo "> [!WARNING]"
	echo "> The Scout stopped before finishing; the partial state it left follows."
	echo ""
	scout_failure_reason
	echo ""
	fi
	cat /tmp/qa-scout/output/report.md
	elif [ -f /tmp/qa-scout/output/verdict.json ]; then
	jq -r '"\(.verdict): \(.headline // "no headline recorded")\n\n_Full report missing (agent stopped early)._"' /tmp/qa-scout/output/verdict.json
	echo ""
	scout_failure_reason
	elif [ "$SCOUT_RUN" = "true" ]; then
	echo "The Scout produced no verdict."
	echo ""
	scout_failure_reason
	elif [ "$SCOUT_PREP_OUTCOME" = "failure" ]; then
	echo "Did not run: the prepare step failed; see its logs."
	else
	echo "Did not run: skipped by the prepare step (no merged PR, [no-qa], or i18n translation PR)."
	fi
	} >> "$GITHUB_STEP_SUMMARY"
	# Surfaced on the run page too, so a dead Scout is visible without
	# opening the summary.
	if [ "$SCOUT_RUN" = "true" ] && [ ! -f /tmp/qa-scout/output/report.md ]; then
	echo "::warning title=QA Scout produced no report::$(head -n 1 /tmp/qa-scout/agent-stderr.log 2>/dev/null \|\| echo 'see the job summary for why')"
	fi

	- name: QA Scout / Upload report
	if: ${{ !cancelled() && steps.qa-scout-pr.outputs.run == 'true' }}
	continue-on-error: true
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
	with:
	name: qa-scout-report
	path: \|
	/tmp/qa-scout/context/
	/tmp/qa-scout/output/
	/tmp/qa-scout/browser/
	/tmp/qa-scout/server.log
	/tmp/qa-scout/worker.log
	/tmp/qa-scout/execution.json
	/tmp/qa-scout/agent-stderr.log
	/tmp/qa-scout/agent-exit.txt
	if-no-files-found: ignore
	retention-days: 14

	ci-e2e-main-status-check:
	if: always() && !cancelled()
	timeout-minutes: 5
	runs-on: ubuntu-latest
	needs: [e2e-test]
	steps:
	- name: Fail job if any needs failed
	if: contains(needs.*.result, 'failure')
	run: exit 1

	notify-main-ci-failure:
	if: always() && github.event_name == 'push' && contains(needs.*.result, 'failure')
	timeout-minutes: 5
	runs-on: ubuntu-latest
	needs: [e2e-test]
	steps:
	- name: Ping engineering on main CI failure
	run: \|
	curl -fsS -X POST https://engineering.twenty.com/s/main-ci-failing \
	-H 'Content-Type: application/json' \
	-d '{
	"commit": "${{ github.sha }}",
	"actor": "${{ github.actor }}",
	"run_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
	}'

	# Posts the QA Scout verdict as a comment on the merged PR. Separate job so
	# pull-requests:write never coexists with the agent step: the agent reads
	# untrusted page/log content, so the write TARGET is bound to the prepare
	# step's trusted pr_number output and the agent-authored artifact can only
	# influence the comment's content, never where it lands.
	# Quiet on PASS; FAIL/INVESTIGATE post (or update) a single marked comment.
	# Kill switch: set repo variable QA_SCOUT_DISABLE_COMMENTS=true.
	qa-scout-comment:
	if: >
	always() && !cancelled() &&
	needs.e2e-test.outputs.qa-scout-run == 'true' &&
	vars.QA_SCOUT_DISABLE_COMMENTS != 'true'
	timeout-minutes: 5
	runs-on: ubuntu-latest
	needs: [e2e-test]
	permissions:
	contents: read
	pull-requests: write
	steps:
	- name: Download QA Scout report
	id: download
	continue-on-error: true
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
	with:
	name: qa-scout-report
	path: qa-scout-report

	- name: Post verdict comment
	if: steps.download.outcome == 'success'
	env:
	GH_TOKEN: ${{ github.token }}
	RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
	PR_NUMBER: ${{ needs.e2e-test.outputs.qa-scout-pr-number }}
	run: \|
	set -euo pipefail
	if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
	echo "No trusted PR number from the prepare step; nothing to post."
	exit 0
	fi
	VERDICT_FILE=$(find qa-scout-report -name verdict.json \| head -1 \|\| true)
	REPORT_FILE=$(find qa-scout-report -name report.md \| head -1 \|\| true)
	if [ -z "$VERDICT_FILE" ]; then
	echo "No verdict in the artifact; nothing to post."
	exit 0
	fi
	# A run killed on turns or time can leave the verdict without the
	# report; a synthesized body beats silence on a FAIL.
	if [ -z "$REPORT_FILE" ]; then
	REPORT_FILE=report-fallback.md
	jq -r '"\(.verdict): \(.headline // "no headline recorded")\n\n" + ([.scenarios[]? \| "- \(.name): \(.result)"] \| join("\n")) + "\n\n_Full report missing (agent stopped early); details in the qa-scout-report artifact._"' \
	"$VERDICT_FILE" > "$REPORT_FILE"
	fi
	VERDICT=$(jq -r '.verdict // empty' "$VERDICT_FILE")
	case "$VERDICT" in
	PASS \| INVESTIGATE \| FAIL) ;;
	*)
	echo "Invalid or missing verdict '${VERDICT}' in verdict.json; not posting."
	exit 0
	;;
	esac
	# A checkpoint left by a run that died is not a finding: it says
	# the Scout failed, not that the PR is broken. Only a finished run
	# speaks, unless the partial state already caught something real: a
	# failed scenario, or a top-level FAIL (which is how a boot failure
	# arrives, before any scenario exists to fail).
	STATUS=$(jq -r '.status // "final"' "$VERDICT_FILE" 2>/dev/null \|\| echo final)
	FAILED_COUNT=$(jq '[.scenarios[]? \| select(.result == "fail")] \| length' "$VERDICT_FILE" 2>/dev/null \|\| echo 0)
	if [ "$STATUS" != "final" ] && [ "${FAILED_COUNT:-0}" -eq 0 ] && [ "$VERDICT" != "FAIL" ]; then
	echo "Scout did not finish (status=${STATUS}) and recorded no failing scenario; nothing to post. See the job summary and artifact."
	exit 0
	fi
	ARTIFACT_PR=$(jq -r '.prNumber // empty' "$VERDICT_FILE")
	if [ "$ARTIFACT_PR" != "$PR_NUMBER" ]; then
	echo "verdict.json prNumber (${ARTIFACT_PR:-none}) differs from the trusted target #${PR_NUMBER}; the trusted target wins."
	fi
	EXISTING=$(gh api --paginate "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments?per_page=100" \
	--jq '.[] \| select((.body // "") \| startswith("<!-- qa-scout -->")) \| .id' \
	\| jq -rs 'first // empty')
	if [ "$VERDICT" = "PASS" ]; then
	if [ -z "$EXISTING" ]; then
	echo "Verdict PASS for PR #${PR_NUMBER}; staying quiet (report is in the job summary and artifact)."
	exit 0
	fi
	# A stale FAIL/INVESTIGATE comment misleads forever if a later
	# PASS never speaks: refresh the existing comment, still without
	# creating one.
	{
	echo "<!-- qa-scout -->"
	echo "> [!NOTE]"
	echo "> A newer QA Scout run passed; the earlier finding on this PR no longer stands."
	echo ""
	echo "[QA Scout run](${RUN_URL}) · verdict: PASS · re-run: Actions → CI E2E Main → Run workflow with pr_number=${PR_NUMBER}"
	} > comment.md
	gh api --method PATCH "repos/${GITHUB_REPOSITORY}/issues/comments/${EXISTING}" -F body=@comment.md
	exit 0
	fi
	{
	echo "<!-- qa-scout -->"
	if [ "$STATUS" != "final" ]; then
	echo "> [!WARNING]"
	echo "> The QA Scout stopped before finishing; what follows is partial."
	echo ""
	fi
	# Drops a multi-byte character split by the byte cap so the payload
	# stays valid UTF-8 (iconv -c exits 1 on exactly this case, so
	# python does the lenient decode).
	head -c 60000 "$REPORT_FILE" \| python3 -c "import sys; sys.stdout.write(sys.stdin.buffer.read().decode('utf-8', 'ignore'))"
	echo ""
	echo ""
	echo "[QA Scout run](${RUN_URL}) · verdict: ${VERDICT} · re-run: Actions → CI E2E Main → Run workflow with pr_number=${PR_NUMBER}"
	} > comment.md
	# Belt over the scrub step's suspenders: a token shape surviving to
	# here means the scrub was bypassed, so fail loudly instead of
	# publishing.
	if grep -q 'sk-ant-' comment.md; then
	echo "Refusing to post: comment contains an Anthropic token shape."
	exit 1
	fi
	if [ -n "$EXISTING" ]; then
	gh api --method PATCH "repos/${GITHUB_REPOSITORY}/issues/comments/${EXISTING}" -F body=@comment.md
	else
	gh api --method POST "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" -F body=@comment.md
	fi

Navigation Menu

Uh oh!

Import Fathom recording media asynchronously #22533

Workflow file

Import Fathom recording media asynchronously #22533

Uh oh!

Workflow file for this run