Mark the Slack app as vetted and release it as 1.0.0 - #25214
Mark the Slack app as vetted and release it as 1.0.0#25214abdulrahmancodes wants to merge 1 commit into
Conversation
|
👋 Thanks for contributing to Twenty! Your PR has been set to draft while you work on it. Once you're done, mark it as Ready for review and our automated checks will run. Looking forward to your contribution! |
Greptile SummaryThe PR promotes the Slack application to a vetted 1.0.0 release and aligns its marketplace metadata, OAuth manifest, and setup documentation with other first-party applications.
Confidence Score: 5/5The PR appears safe to merge, with no concrete changed-code defect identified. Slack’s vetted identifier matches its application identity, its OAuth scopes match the runtime provider, and the documented callback and webhook routes align with executable definitions. Important Files Changed
Reviews (1): Last reviewed commit: "Release the Slack app as 1.0.0" | Re-trigger Greptile |
🤖 PR Review
🛡️ Security Review✅ No high-severity vulnerabilities detected. 🚦 Auto-approve✅ Eligible for auto-approval — low-complexity, no high-blast-radius paths.
Automated pre-review — human approval still required. |
✅ Quality review · no findings
High-level — Additive version promotion (0.6.0→1.0.0) plus one vetted-marketplace entry whose UUID matches the Slack app's APPLICATION_UNIVERSAL_IDENTIFIER at a sequential, non-duplicate position 5; no migration, breaking change, or rollout risk. Reviewed against the |
CoreTeamTwenty
left a comment
CoreTeamTwenty
left a comment
There was a problem hiding this comment.
✅ Auto-approved — cleared automated quality and security review and is low-complexity.
- Quality: passed
- Security: passed
- Auto-approve: passed — complexity low
Automated approval — a human still merges, and this is re-evaluated on every push.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 6 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Superseded — re-approving the latest commit.
CoreTeamTwenty
left a comment
CoreTeamTwenty
left a comment
There was a problem hiding this comment.
✅ Auto-approved — cleared automated quality and security review and is low-complexity.
- Quality: passed
- Security: passed
- Auto-approve: passed — complexity low
Automated approval — a human still merges, and this is re-evaluated on every push.
Superseded — re-approving the latest commit.
CoreTeamTwenty
left a comment
CoreTeamTwenty
left a comment
There was a problem hiding this comment.
✅ Auto-approved — cleared automated quality and security review and is low-complexity.
- Quality: passed
- Security: passed
- Auto-approve: passed — complexity low
Automated approval — a human still merges, and this is re-evaluated on every push.
ee37356 to
60d987f
Compare
Superseded — re-approving the latest commit.
CoreTeamTwenty
left a comment
CoreTeamTwenty
left a comment
There was a problem hiding this comment.
✅ Auto-approved — cleared automated quality and security review and is low-complexity.
- Quality: passed
- Security: passed
- Auto-approve: passed — complexity low
Automated approval — a human still merges, and this is re-evaluated on every push.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
Superseded — re-approving the latest commit.
CoreTeamTwenty
left a comment
CoreTeamTwenty
left a comment
There was a problem hiding this comment.
✅ Auto-approved — cleared automated quality and security review and is low-complexity.
- Quality: passed
- Security: passed
- Auto-approve: passed — complexity low
Automated approval — a human still merges, and this is re-evaluated on every push.
Add the Slack app to MARKETPLACE_VETTED_APPLICATIONS. isVetted is recomputed on every catalog upsert, so existing registrations pick it up on the next sync without an upgrade command. Bump 0.6.0 to 1.0.0. Nothing in the platform gates on the major, so this is a signal that the object model, the webhook route ids and the workflow step field names are stable. The catalog reads the app's display metadata from the published tarball, so publish this version only once the docs and metadata change has merged.
aa4d0d0 to
cb4270d
Compare
Superseded — re-approving the latest commit.
CoreTeamTwenty
left a comment
CoreTeamTwenty
left a comment
There was a problem hiding this comment.
✅ Auto-approved — cleared automated quality and security review and is low-complexity.
- Quality: passed
- Security: passed
- Auto-approve: passed — complexity low
Automated approval — a human still merges, and this is re-evaluated on every push.
) `im:write` is requested at connect time by the Slack connection provider (`slack-connection.ts:28`) but was absent from both `slack-app-manifest.json` and the scopes table in `SETUP.md`. Slack validates that every scope requested at authorize time appears under the app's Bot Token Scopes, so a Slack app created from this manifest fails OAuth. The setup guide warns about exactly this failure mode a few lines above the table it was missing from. ## Scope Affects **newly created Slack apps only**. The scope itself already shipped in 0.5.0, and the README has told people to reconnect for it since then, so existing installs need no action. ## Why this is its own PR Split out of [twentyhq#25214](twentyhq#25214) so a live OAuth breakage isn't queued behind a documentation review. That PR now carries only the vetted-marketplace flag and the version bump. ## Test plan - [ ] A Slack app created from the updated manifest completes the OAuth connect flow --- _Generated by [Claude Code](https://claude.ai/code/session_01FVj51vPJYMhvfkRoppynJW)_ <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/25234?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
![https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source](https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source){kind=link}
![https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img](https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img){kind=link}
![https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a](https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a){kind=link}
…25235) Brings the Slack app's documentation and marketplace metadata up to the standard the other first-party apps set. Split out of [twentyhq#25214](twentyhq#25214), which now carries only the vetted flag and the version bump. ## Docs `README.md` and `SETUP.md` were denser and differently shaped than the other apps': - README follows the Call Recorder / Last Contact / People Data Labs shape: pitch line, `What you get`, `Billing`, `Heads up`. The user-links and consent detail, which ran about twice the length of any other app's entire README, moved into the setup guide. - SETUP.md follows Call Recorder's, the only real setup guide among the vetted apps: admin framing with a Twenty Cloud note, `What you need to wire up` before any steps, a server variables table, and a troubleshooting table collecting failure modes that were previously inline asides scattered through the prose. - The server-URL placeholder now matches Call Recorder's form, in both the guide and the manifest. Every fact from the previous versions is preserved, just relocated. The roster sweep and unlinked-users list from twentyhq#25151 are folded into both files. ## Billing correction The README claimed the app was free and unmetered. It isn't. Logic function runs are billed per invocation plus runtime (`logic-function-billing.constant.ts`), and the `message.channels` / `message.groups` subscriptions deliver every message posted in a channel the bot belongs to. The resolver dispatches all of them to `slack-events-enqueue`, which runs in the customer's workspace and only then drops the irrelevant ones, so the invocation is already billed by the time the message is discarded. The section now states the rate, explains that messages the bot never answers still cost an invocation, and documents dropping the two subscriptions as the lever for anyone who only wants explicit mentions and DMs. The alternative was adding the app to `MARKETPLACE_BILLING_EXEMPT_UNIVERSAL_IDENTIFIERS` alongside Call Recorder and Last Contact. Documenting the real cost was the call here; happy to switch if the exemption is preferred. ## Metadata `websiteUrl` now points at the app folder rather than the generic app-development docs, since it is the only link from the marketplace detail page to the setup guide. Server-variable descriptions tightened, and `SLACK_WEBHOOK_SECRET` now says it covers interactivity requests too, which it did but wasn't documented. ## Slack's PKCE opt-in SETUP.md now says to leave it off, with the reason. Enabling it reclassifies the app as a public client (one-way, reversible only by Slack support) while `exchangeCodeForToken` sets `client_secret` unconditionally, and it stops a localhost redirect from requesting bot scopes. Note that dropping `client_secret` whenever `usePkce` is true would be the wrong fix: `usePkce` defaults to true for every provider and Linear already runs that flow against a confidential client, where sending both is correct. ## Merge order Contains the `im:write` manifest line from [twentyhq#25234](twentyhq#25234) so the rewritten scopes table is correct standalone. If twentyhq#25234 merges first the hunk is a no-op. Merge this before publishing 1.0.0 from twentyhq#25214 — the catalog reads `description` and `websiteUrl` from the published tarball, so a publish that predates this ships the old metadata. ## Test plan - [ ] Marketplace detail page shows the new description and a Website link to the app folder --- _Generated by [Claude Code](https://claude.ai/code/session_01FVj51vPJYMhvfkRoppynJW)_ <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/25235?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
2 participants
Marks the Slack app as vetted in the marketplace and releases it as 1.0.0. Two files, five lines.
Previously this PR also carried a docs rewrite, a billing correction and a manifest scope fix. Those are independent and now sit in their own PRs, so the vetting decision can be reviewed on its own:
im:writemanifest scope, a live OAuth breakage for newly created Slack appsapplication.config.tsmetadataVetting
Adds the Slack app to
MARKETPLACE_VETTED_APPLICATIONSat position 5.isVettedis recomputed on everyupsertFromCatalog, so existing registrations pick it up on the next catalog sync. No upgrade command or migration is needed, and nothing in the test suite references the constant.Two things outside this diff still gate the listing, both already true for Call Recorder, which is the only other app with a server route:
isServerRouteConfiguredreturns false otherwise, and the catalog cache drops the app whether or not it is vetted.SLACK_CLIENT_IDandSLACK_CLIENT_SECRETmust be set on the registration, same filter.The app is not added to
ONBOARDING_INSTALLABLE_APPS. That step installs with one click, and Slack cannot work until an admin has created a Slack app and set its credentials.Version
0.6.0 to 1.0.0. Nothing in the platform gates on the major version —
validateVersionProgressiononly requires valid semver and a strict increase — so this is a signal rather than a mechanism: the object model, the webhook route IDs and the workflow step field names are stable.Publish order matters. The catalog reads
description,websiteUrland the logo from the published tarball, so publish 1.0.0 to npm only after #25235 has merged. Publishing before that ships 1.0.0 with the oldwebsiteUrlpointing at the generic app-development docs, and #25235 would then need a second bump to reach the marketplace.Not included
Gallery images. The vetted apps share a cover template (golden-ratio canvas,
#F1F1F1ground, window inset at 14.8% / 16.8% bleeding off the right and bottom,#4A38F5callout on the region the app adds) that Slack has no assets for yet. In progress separately.Test plan
isVettedon the existing@twentyhq/slackregistration