CKEditor 5 CI utilities

Utils for CKEditor 5 CI builds.

Contains tools for sending Slack notifications from Circle CI and GitHub Actions workflows.

Available scripts

These commands accept a mix of environment variables and command line arguments. Environment variables are preferred when the value comes from the CI environment or is sensitive (like tokens). Command line arguments are preferred when the value is static or local to a given repository.

[!WARNING] Tokens are passed as environment variables to avoid exposing sensitive credentials in shell history, CI logs, or shared configuration files.

• ⚙️ ckeditor5-dev-ci-circle-disable-auto-cancel-builds

  Disables the “Auto-cancel redundant workflows” option in CircleCI for a given repository. Useful during release processes to prevent CircleCI from canceling the workflow triggered by the release commit itself.

  Environment variables:

  • CKE5_CIRCLE_TOKEN — CircleCI API token used for authentication.

  Parameters:

  • --organization — GitHub organization name.
  • --repository — GitHub repository name.

• ⚙️ ckeditor5-dev-ci-circle-enable-auto-cancel-builds

  Enables the “Auto-cancel redundant workflows” option in CircleCI for a given repository. Should be used after a release workflow that temporarily disables this option using the ckeditor5-dev-ci-circle-disable-auto-cancel-builds script.

  Environment variables:

  • CKE5_CIRCLE_TOKEN — CircleCI API token used for authentication.

  Parameters:

  • --organization — GitHub organization name.
  • --repository — GitHub repository name.

• ⚙️ ckeditor5-dev-ci-circle-workflow-notifier

  Waits for all jobs in the current CircleCI workflow to finish (success or error) and then runs a final command (the "notifier"). Intended to run as a dedicated job in your workflow. The script itself handles waiting – you typically don’t add requires on this job.

  Environment variables:

  • CKE5_CIRCLE_TOKEN — CircleCI API token used for authentication.

  CircleCI-provided variables:

  • CIRCLE_WORKFLOW_ID — ID of the current workflow.
  • CIRCLE_JOB — Name of the current job.

  Parameters:

  • --task — Command to execute at the end; default: pnpm ckeditor5-dev-ci-notify-circle-status.
  • --ignore — Job name to ignore when waiting (repeatable; can be passed multiple times).

  Behavior:

  • Retries transient CircleCI API errors up to 5 attempts with a 10s delay between attempts.
  • Fails immediately for non-retryable API errors (for example: invalid token or wrong workflow ID).
  • If transient errors persist, it exits with an explicit message asking to verify workflow results manually.

• ⚙️ ckeditor5-dev-ci-is-job-triggered-by-member

  Verifies that a CircleCI approval job was approved by a user who belongs to a specified GitHub team. Uses CircleCI and GitHub APIs to check the approver against the team membership.

  Environment variables:

  • CKE5_CIRCLE_TOKEN — CircleCI API token used for authentication.
  • CKE5_GITHUB_TOKEN — GitHub token used to query team membership.

  CircleCI-provided variables:

  • CIRCLE_WORKFLOW_ID — ID of the current workflow.

  Parameters:

  • --job — Name of the approval job to verify.
  • --organization — GitHub organization name.
  • --team — GitHub team name (slug) to validate against.

• ⚙️ ckeditor5-dev-ci-is-workflow-restarted

  Checks whether the current CircleCI workflow has been restarted. If a restart is detected, the script exits with a zero exit code, allowing the pipeline to continue conditionally.

  Environment variables:

  • CKE5_CIRCLE_TOKEN — CircleCI API token used for authentication.

  CircleCI-provided variables:

  • CIRCLE_WORKFLOW_ID — ID of the current workflow (set by CircleCI).

• ⚙️ ckeditor5-dev-ci-notify-circle-status

  Sends a Slack notification summarizing the current CircleCI build/workflow status. For failed builds, fetches the commit author via the GitHub API (works with private repositories).

  Environment variables:

  • CKE5_GITHUB_TOKEN — GitHub token with the repo scope, used to fetch commit author.
  • CKE5_CIRCLE_TOKEN — CircleCI API token used for API calls.
  • CKE5_SLACK_WEBHOOK_URL — Incoming Webhook URL for the Slack channel receiving notifications.

  CircleCI-provided variables:

  • CIRCLE_BRANCH — The number of the current build.
  • CIRCLE_PROJECT_REPONAME — Repository name.
  • CIRCLE_PROJECT_USERNAME — Organization/user name.
  • CIRCLE_SHA1 — Commit SHA of the current build.
  • CIRCLE_WORKFLOW_ID — ID of the current workflow.

  Parameters:

  • --pipeline-id &mdash Value of Circle's << pipeline.number >> parameter (read more).
  • --trigger-repository-slug — <org>/<repo> to construct the commit URL when provided with --trigger-commit-hash. Useful when a pipeline was triggered via a different repository.
  • --trigger-commit-hash — Commit SHA to construct the commit URL. Useful when a pipeline was triggered via a different repository.
  • --hide-author — "true"/"false" to hide the author in Slack.

• ⚙️ ckeditor5-dev-ci-notify-github-actions-status

  Sends a Slack notification summarizing the current GitHub Actions workflow run. Designed to be called from a step (or dedicated job) gated by if: failure(); the script does not check the workflow status before sending the notification. Fetches the commit author and workflow run start time via the GitHub API (works with private repositories).

  Environment variables:

  • CKE5_GITHUB_TOKEN — GitHub token with the repo scope, used to fetch commit author and workflow run metadata.
  • CKE5_SLACK_WEBHOOK_URL — Incoming Webhook URL for the Slack channel receiving notifications.

  GitHub-provided variables:

  • GITHUB_REPOSITORY — <owner>/<repo> of the current workflow.
  • GITHUB_REF_NAME — Branch or tag name that triggered the workflow.
  • GITHUB_SHA — Commit SHA of the current run.
  • GITHUB_RUN_ID — ID of the current workflow run.
  • GITHUB_RUN_ATTEMPT — (Optional) Run attempt number; included in the Slack message when greater than 1.
  • GITHUB_WORKFLOW — (Optional) Display name of the current workflow.
  • GITHUB_SERVER_URL — (Optional) Server URL; defaults to https://github.com.
  • GITHUB_API_URL — (Optional) API base URL; defaults to https://api.github.com.

  Parameters:

  • --trigger-repository-slug — <org>/<repo> to construct the commit URL when provided with --trigger-commit-hash. Useful when a workflow was triggered via a different repository.
  • --trigger-commit-hash — Commit SHA to construct the commit URL. Useful when a workflow was triggered via a different repository.
  • --hide-author — "true"/"false" to hide the author in Slack.

• ⚙️ ckeditor5-dev-ci-trigger-circle-build

  Triggers a new CircleCI pipeline for a specified repository. Commonly used to initiate release or follow-up pipelines from an existing workflow.

  Environment variables:

  • CKE5_CIRCLE_TOKEN — CircleCI API token used for authentication.

  CircleCI-provided variables:

  • CIRCLE_BRANCH — Git branch of the currently processed pipeline.
  • CIRCLE_SHA1 — Full commit SHA of the currently processed pipeline.

  Parameters:

  • --slug — Repository slug (org/name) where the new pipeline will be started.
  • --trigger-repository-slug — (Optional) Repository slug (org/name) that triggered the new pipeline. Can be omitted if it matches --slug.
  • --release-branch — (Optional) Branch that leads the release process.
  • --pipeline-definition-id — (Optional) GitHub App pipeline definition ID. When provided, the specified pipeline definition is triggered instead of the project's default OAuth pipeline.

• ⚙️ ckeditor5-dev-ci-trigger-snyk-scan

  Publishes Snyk code and dependency snapshots for the current branch. It configures the Snyk CLI to use the EU endpoint and the provided organization, then runs snyk code test and snyk monitor commands.

  Environment variables:

  • SNYK_TOKEN — Snyk token used for authentication.
  • DEBUG — (Optional) When set, appends -d to snyk code test and snyk monitor for verbose output, and removes --silent from the pnpm invocation.

  CircleCI-provided variables:

  • CIRCLE_BRANCH — Git branch used as Snyk's target-reference.

  Parameters:

  • --depth — (Optional) Detection depth passed to snyk monitor as --detection-depth. Defaults to 2.
  • --exclude — (Optional, repeatable) Additional directory or file name to exclude from Snyk's dependency snapshot. Use multiple times, for example --exclude=build --exclude=dist. The provided values are merged with the built-in defaults (external, tests, node_modules, release, scripts).
  • --organization — Snyk organization ID or slug.

  Behavior:

  • Always excludes external, tests, node_modules, release and scripts from dependency snapshot detection. Any paths provided via --exclude are merged with these defaults (duplicates are ignored).
  • Passes --detection-depth (default: 2) to snyk monitor to limit how deep Snyk scans for manifest files, which avoids performance issues caused by deeply nested node_modules trees.
  • Accepts exit code 1 from snyk code test, so code snapshots are still published when vulnerabilities are found.
  • Requires exit code 0 from snyk monitor, because any other code means the dependency snapshot was not created.

Changelog

See the CHANGELOG.md file.

License

Licensed under the terms of GNU General Public License Version 2 or later. For full details about the license, please check the LICENSE.md file.