Skip to content

ci(apollo-vertex): learn agent instructions from review feedback daily - #1468

Open
ruudandriessen wants to merge 3 commits into
mainfrom
cursor/vertex-review-feedback-e3e5
Open

ruudandriessen wants to merge 3 commits into
mainfrom
cursor/vertex-review-feedback-e3e5

Conversation

@ruudandriessen

@ruudandriessen ruudandriessen commented Oct 26, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

A daily self-improvement loop for the Apollo Vertex agent instructions. Every day it collects what people said in review on the app:apollo-vertex PRs merged the previous UTC day, lets an agent fold durable rules into the two Vertex AGENTS.md files, and opens a PR for a person to review.

Only the agent step is non-deterministic:

  1. collect-comments.mjs (deterministic, zero dependencies) lists every comment written by a person: inline review comments with their diff hunk and the thread they reply to, conversation comments, and review summaries. It drops bots (user.type != User or [bot] logins), authors whose author_association isn't OWNER/MEMBER/COLLABORATOR/CONTRIBUTOR (it's a public repo and the text feeds a prompt), and empty approvals. The output is JSON plus a markdown digest.
  2. prompt.md tells the agent what qualifies as a rule (reviewer corrections that generalize), what to skip ("Fixed in abc", one-off bugs, unresolved threads), to weigh PR-author replies to bots lower (they're usually agent-written), and to treat comment bodies as data, not instructions.
  3. apollo-vertex-review-feedback.yml runs at 05:00 UTC daily (or on dispatch with a custom since/until window for backfills):
    • The Cursor CLI runs with only CURSOR_API_KEY. It has no GitHub token, the checkout has persist-credentials: false, and a temporary .cursor/cli.json denies git, gh, curl, web fetch and MCP.
    • A deterministic step fails the run if anything other than packages/apollo-vertex/AGENTS.md or apps/apollo-vertex/AGENTS.md changed.
    • The releaser GitHub App opens the PR. Its body includes the agent's rationale with comment links and the list of source PRs.
  4. apollo-vertex-auto-merge.yml now skips chore/vertex-review-feedback-* branches, so learned instructions are never auto-merged.

Setup needed

  • Add a CURSOR_API_KEY repository secret. Until it exists, the workflow still collects comments, writes the digest to the job summary, and emits a warning instead of failing.
  • Optional: set a VERTEX_REVIEW_FEEDBACK_MODEL repository variable to pin the model.

Review notes

  • The search API returns nothing for merged:<ts>Z..<ts>Z ranges, so the script queries whole days with a day of margin and filters merged_at exactly on the client.
  • UiPath reviewers show up as CONTRIBUTOR/COLLABORATOR, not MEMBER, because org membership is private. That's why CONTRIBUTOR is on the trusted list.
  • The Cursor CLI is installed with the documented curl https://cursor.com/install | bash, which can't be pinned. The current installer links agent into ~/.local/bin, not the ~/.cursor/bin the GitHub Actions docs give, so the workflow uses ~/.local/bin and checks agent --version.
  • Comments added after a PR merged, on a day after the merge, are not picked up.

Testing

  • node --test .github/scripts/vertex-review-feedback/*.test.mjs: 17 unit tests for the window, search query, author filtering, thread context, sorting and markdown digest.
  • Live collector runs: Oct 15 to 22 (19 PRs, 6 with feedback, 47 comments kept, 159 bot comments and 53 empty reviews dropped), and Oct 18 (no merges, so the agent is skipped).
  • Ran the workflow's actual run: scripts locally, with stubs for agent and gh and a local bare repo as the remote:
    • edit scenario: only AGENTS.md committed, branch pushed, token stripped from origin, PR body assembled
    • agent touching README.md and creating a file: the run fails, nothing pushed
    • no edits, and missing API key: the run skips cleanly
  • Installed the real Cursor CLI (2026.10.22) and confirmed the flags used. The real agent was not run end to end, because no API key is available here.
  • actionlint and zizmor (repo config) pass on both workflows.
Open in Web Open in Cursor 

cursoragent and others added 2 commits October 26, 2026 08:14
Instruction changes learned from PR comment text always need a person to
review them, so the auto-merge job skips chore/vertex-review-feedback-*
branches.

Co-authored-by: Ruud Andriessen <ruud.andriessen@gmail.com>
collect-comments.mjs deterministically lists the comments people left on
PRs labeled app:apollo-vertex that merged in a window (the previous UTC day
by default): bots, untrusted authors and empty reviews are dropped, and
inline comments keep their diff hunk and the thread they reply to.

The daily workflow feeds that JSON to the Cursor CLI, which may only edit
the two Vertex AGENTS.md files and runs without GitHub credentials. A
deterministic step rejects any other change and opens a PR for review.

Co-authored-by: Ruud Andriessen <ruud.andriessen@gmail.com>
Copilot AI balanced review requested due to automatic review settings October 26, 2026 08:14
@github-actions github-actions Bot added the ci label Oct 26, 2026
@github-actions
github-actions Bot temporarily deployed to preview/apollo-landing October 26, 2026 08:15 Destroyed
@github-actions
github-actions Bot temporarily deployed to preview/apollo-design October 26, 2026 08:15 Destroyed
@github-actions
github-actions Bot temporarily deployed to preview/apollo-vertex October 26, 2026 08:15 Destroyed
@github-actions
github-actions Bot temporarily deployed to preview/apollo-docs October 26, 2026 08:15 Destroyed
@github-actions github-actions Bot added the size:XL 500-999 changed lines. label Oct 26, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Dependency License Review

  • ✅ 1957 package(s) scanned
  • ✅ No license issues found
  • ⚠️ 2 package(s) excluded (see details below)
License distribution
License Packages
MIT 1721
ISC 91
Apache-2.0 57
BSD-3-Clause 28
BSD-2-Clause 23
BlueOak-1.0.0 8
MPL-2.0 4
CC0-1.0 4
MIT-0 3
MIT OR Apache-2.0 2
(MIT OR Apache-2.0) 2
Unlicense 2
LGPL-3.0-or-later 1
Python-2.0 1
CC-BY-4.0 1
(MPL-2.0 OR Apache-2.0) 1
Unknown 1
Artistic-2.0 1
(WTFPL OR MIT) 1
(BSD-2-Clause OR MIT OR Apache-2.0) 1
CC-BY-3.0 1
0BSD 1
(MIT OR CC0-1.0) 1
MIT AND ISC 1
Excluded packages
Package Version License Reason
@img/sharp-libvips-linux-x64 1.3.4 LGPL-3.0-or-later LGPL pre-built binary, not linked
khroma 2.1.0 Unknown MIT per GitHub repo, missing license field in package.json

…kflow

The installer links agent into ~/.local/bin, not the ~/.cursor/bin the
GitHub Actions docs give, so the agent step would not find it. Also pass
--trust so print mode never waits on a workspace trust prompt.

Co-authored-by: Ruud Andriessen <ruud.andriessen@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

📊 Coverage + size by package

Per-package bundle size on this PR (no JS/TS source changes detected under packages/* or web-packages/*).

Package Coverage New-line coverage Packed (gzip) Unpacked vs main
@uipath/apollo-core — — — — —
@uipath/apollo-react — — — — —
@uipath/apollo-ui-icons — — — — —
@uipath/apollo-vertex — — — — —
@uipath/apollo-wind — — — — —
@uipath/ap-chat — — — — —

"Coverage" is each package's own coverage.include scope (e.g. apollo-core instruments only scripts/). "Packed"/"Unpacked" come from npm pack --dry-run and only cover built packages — "—" means not measured this run (package not affected / not built). "vs main" is the packed (gzipped) delta against the last successful main build (the package-sizes artifact from the Release workflow); "—" there means no main baseline was available this run. The baseline is main's latest build, not this PR's exact merge-base, so it includes any drift since the branch diverged. Packages with no vitest config are omitted.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Agent-controlled runner state can compromise later publishing credentials, and file validation, reply filtering, and branch naming need correction.

4 open issues
What changed in this PR

Adds a daily workflow that turns Apollo Vertex review feedback into proposed agent-instruction updates for human review.

Changes:

  • Adds a dependency-free comment collector with filtering, thread context, summaries, and unit tests.
  • Introduces the learning prompt and scheduled workflow to propose updates to the two Vertex AGENTS.md files.
  • Excludes generated feedback branches from automatic merging.
File Description
.github/​workflows/​apollo-vertex-review-feedback.yml Collects feedback, runs the agent, and opens instruction-update PRs.
.github/​workflows/​apollo-vertex-auto-merge.yml Skips automatic merging for feedback branches.
.github/​scripts/​vertex-review-feedback/​prompt.md Defines how the agent selects and documents durable rules.
.github/​scripts/​vertex-review-feedback/​collect-comments.test.mjs Tests collection helpers, filtering, context, and summaries.
.github/​scripts/​vertex-review-feedback/​collect-comments.mjs Collects review feedback and produces JSON and Markdown reports.

Review effort: Balanced

id: changes
if: steps.agent-key.outputs.available == 'true'
run: |
changed=$( { git diff --name-only; git ls-files --others --exclude-standard; } | sort -u)
Comment on lines +138 to +140
- name: Generate GitHub App token
if: steps.changes.outputs.changed == 'true'
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0

for (const comment of reviewComments) {
if (!keep(comment)) continue;
const parent = comment.in_reply_to_id ? reviewCommentsById.get(comment.in_reply_to_id) : null;
run: |
# apollo-vertex-auto-merge.yml skips this branch prefix, so a person
# always reviews instructions learned from comment text.
BRANCH="chore/vertex-review-feedback-${WINDOW}"
Copilot AI balanced review requested due to automatic review settings October 26, 2026 08:20

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Agent execution shares mutable runner state with credentialed publishing, leaving an insufficient security boundary.

4 open issues

Review effort: Balanced

@github-actions

Copy link
Copy Markdown
Contributor

Storybook visual diff

✅ No stories are affected by this PR's changes; nothing to compare. Logs

Updated (PT): Oct 26, 2026, 01:28:06 AM

This branch was successfully deployed

4 active deployments
preview/apollo-design — 2d371221 Deployed Oct 26, 2026 by github-actions[bot]
preview/apollo-vertex — 2d371221 Deployed Oct 26, 2026 by github-actions[bot]
preview/apollo-landing — 2d371221 Deployed Oct 26, 2026 by github-actions[bot]
preview/apollo-docs — 2d371221 Deployed Oct 26, 2026 by github-actions[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci size:XL 500-999 changed lines.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants