[ruudandriessen]

TLDR: use github deployments instead of a PR comment, it's much nicer 😄

From this:

To this:

---

Coded App preview URLs were posted in a PR comment table that two extra jobs kept up to date. They now show up as GitHub Deployments, in the PR timeline and the merge box, and production deploys on main report the same way.

Previews: each matrix leg creates a deployment in preview/<app> for the PR head commit, tagged with a per-PR task. It shows as in progress with a link to the run, then success with the preview URL, or failure. Deployments are marked transient_environment so a deploy from another PR doesn't mark this PR's preview inactive. Closing the PR marks its deployments inactive. The comment jobs and script are removed, and only the apollo-design leg still uploads a result artifact, for the visual-diff job.

Production: now runs as a per-app matrix using the job-level environment: production/<app> key with the app URL, instead of four sequential deploys in one job. Turbo cache keys are now per app.

Testing limits: not run yet; actionlint wasn't available locally. On this PR, check that each app's preview appears as a deployment, and that two PRs' previews both stay active. Merging will first create the production/* environments.

[github-actions]

Dependency License Review

• ✅ 1942 package(s) scanned
• ✅ No license issues found
• ⚠️ 2 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1708
ISC	91
Apache-2.0	56
BSD-3-Clause	28
BSD-2-Clause	23
BlueOak-1.0.0	8
MPL-2.0	4
MIT-0	3
CC0-1.0	3
MIT OR Apache-2.0	2
(MIT OR Apache-2.0)	2
Unlicense	2
LGPL-3.0-or-later	1
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
Unknown	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.3.4	LGPL-3.0-or-later	LGPL pre-built binary, not linked
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json

[github-actions]

📊 Coverage + size by package

Per-package bundle size on this PR (no JS/TS source changes detected under packages/* or web-packages/*).

Package	Coverage	New-line coverage	Packed (gzip)	Unpacked	vs main
@uipath/apollo-core	—	—	—	—	—
@uipath/apollo-react	—	—	—	—	—
@uipath/apollo-ui-icons	—	—	—	—	—
@uipath/apollo-vertex	—	—	—	—	—
@uipath/apollo-wind	—	—	—	—	—
@uipath/ap-chat	—	—	—	—	—

_{"Coverage" is each package's own coverage.include scope (e.g. apollo-core instruments only scripts/). "Packed"/"Unpacked" come from npm pack --dry-run and only cover built packages — "—" means not measured this run (package not affected / not built). "vs main" is the packed (gzipped) delta against the last successful main build (the package-sizes artifact from the Release workflow); "—" there means no main baseline was available this run. The baseline is main's latest build, not this PR's exact merge-base, so it includes any drift since the branch diverged. Packages with no vitest config are omitted.}

[Copilot]

🟡 Changes recommended

Mutable-ref handling can misattribute deployments and leave older PR deployments active after closure.

1 open finding

• Use the event's immutable head SHA for deployment lookup · New

What changed in this PR

Moves Coded App reporting from PR comments to GitHub Deployments for preview and production environments.

Changes:

• Adds per-app preview deployment statuses and cleanup.
• Parallelizes production deployments by app.
• Removes the legacy preview-comment implementation.

File	Description
.github/​workflows/​production-deploy.yml	Adds per-app production environments and matrix deployment.
.github/​workflows/​preview-deploy.yml	Creates, finishes, and deactivates preview deployments.
.github/​scripts/​preview-deploy/​preview-comment.mjs	Removes obsolete comment-table handling.
.github/​scripts/​preview-deploy/​deployments.mjs	Implements GitHub Deployment API helpers.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Production deployment orchestration and deployment lifecycle behavior require the stated live workflow validation before approval.

0 open findings

1 resolved since last review

• Use the event's immutable head SHA for deployment lookup

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Previous same-PR deployments remain active, and a Vertex-only credential can incorrectly fail every production matrix leg.

2 open findings

• Scope Vertex credential validation to the Vertex deployment branch · New
• Deactivate older active deployments for the same PR environment · New

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

PR-controlled code receives deployment write access, and status cleanup failures can prevent preview resources from being deleted.

3 open findings

• PR-controlled code can abuse deployment write permissions · New
• Scope Vertex credential validation to the Vertex deployment branch
• Status errors can block preview app cleanup · New

1 resolved since last review

• Deactivate older active deployments for the same PR environment

🧠 Review effort: Balanced

[github-actions]

Storybook visual diff

✅ No stories are affected by this PR's changes; nothing to compare. Logs

Updated (PT): Oct 14, 2026, 05:02:39 AM

[Copilot]

🟡 Changes recommended

App-specific validation, silent cleanup failures, and repeated historical status updates need correction.

2 open findings

• Repeatedly deactivates historical deployments · New
• Cleanup masks API failures and reports false success · New

3 resolved since last review

• PR-controlled code can abuse deployment write permissions
• Scope Vertex credential validation to the Vertex deployment branch
• Status errors can block preview app cleanup

🧠 Review effort: Balanced