ci: add shared visual proof author and shots actions [ED-25578] by davseve · Pull Request #55 · elementor/elementor-editor-github-actions

davseve · 2026-09-17T11:08:42Z

Summary

Extract Visual proof author + Playground recorder from Core into composite actions so Elementor and Elementor Pro can share them.
visual-proof-author writes ## Visual proof when missing; visual-proof-shots records Playground (storyboard actor, then generic walk).
Callers keep their own playground-preview workflow and pass product-name.

Test plan

Confirm node actions/visual-proof/parse-section.js --test passes.
Point elementor/elementor Visual proof workflows at actions/visual-proof-author@<this-branch> and actions/visual-proof-shots@<this-branch> and re-run a PR.
Repeat the same wrappers in elementor/elementor-pro after Playground is green.
Confirm #skip_proof skips capture and a filled section posts a comment.

Visual proof

#skip_proof
GitHub Actions repo; no Elementor editor Playground.

Jira

ED-25578

Made with Cursor

✨ PR Description

1. Problem & Context

Implements shared GitHub Actions for automating the "Visual proof" section of PRs (ED-2578). The goal is to use AI agents to author proof descriptions and generate corresponding screenshots/videos from a WordPress Playground preview.

2. What Changed (Where)

File/Module	Change
`actions/visual-proof-author/`	New composite action using `cursor-agent` to write PR proof sections.
`actions/visual-proof-shots/`	New composite action using Playwright and `cursor-agent` for visual capture.
`actions/visual-proof/parse-section.cjs`	Shared logic to parse and validate the `## Visual proof` markdown section.
`eslint.config.mjs` / `.prettierignore`	Ignored new action directories from linting/formatting.

3. How It Works

Authoring: author.sh uses a Cursor agent to analyze the PR diff and either populate the ## Visual proof section with reproduction steps or mark it #skip_proof.
Capturing: run.sh resolves the playground URL, attempts to run an AI-generated storyboard actor via act.sh, and falls back to a generic "Pages $\rightarrow$ Edit" walk via capture.cjs if the actor fails.
Posting: post-comment.sh uploads captured PNGs/MP4s to a dedicated assets branch and upserts a formatted PR comment.

4. Risks

Security: act.sh runs an unsandboxed AI agent with write access to the checkout; mitigated by blocking fork PRs in the workflow.
Stability: High dependency on cursor-agent and Playwright timeouts; mitigated by continue-on-error: true and fallback capture paths.

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.

💡 Tip: You can customize your AI Description using Guidelines Learn how}

Ref: ED-25578 Co-authored-by: Cursor <cursoragent@cursor.com>

wiz-9a149474ff · 2026-09-17T11:09:18Z

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	4 8
Software Management Findings	-

Total	4 8

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

Ref: ED-25578 Co-authored-by: Cursor <cursoragent@cursor.com>

Ntnelbaba

Inline notes from review — one per finding. Request changes: is CommonJS under root and will break author/shots parse paths.

Ntnelbaba · 2026-09-17T13:18:09Z

+
+        - name: Parse Visual proof section
+          shell: bash
+          run: node "$GITHUB_ACTION_PATH/parse-section.js" --test


This step will fail for the same ESM/CJS reason until the parser is loadable as CJS. Point it at once renamed.

Done — parse step now runs node "$ACTION_PATH/../visual-proof/parse-section.cjs" --test with ACTION_PATH from env (no expression-interpolated path in the script body).

Ntnelbaba · 2026-09-17T13:18:09Z

+
+parse_visual_proof_section() {
+	gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json body --jq .body | node -e '
+	const { shouldCaptureVisualProof, extractBrokenCaption, buildOverlayCaption } = require(process.argv[1]);


Duplicate parser + same breakage as . A single shared would fix loading and avoid drift between the two actions.

Agreed — duplicate parser removed. run.sh now uses the same shared parse-section.cjs.

Ntnelbaba · 2026-09-17T13:18:09Z

+log "step=find-comment looking for existing visual-proof-ci marker"
+existing_id=$(
+	gh_api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate \
+		--jq "[.[] | select(.body | contains(\"visual-proof-ci\")) | .id][0] // empty" || true


swallows list failures, and matching with (not the full HTML marker) can create a second comment instead of updating. Prefer strict errors + exact marker match.

Fixed: dropped || true on the list call, and upsert now matches the full  marker so we update instead of posting a second comment.

Ntnelbaba · 2026-09-17T13:20:12Z

Clarifying the review event: treating the inline notes as comments, not a formal block. Please still fix the parse-section ESM/CJS issue before relying on these actions in CI — that one is load-bearing — but I’m not holding the PR on REQUEST_CHANGES for process reasons.

…docs - Rename parse-section.js to shared parse-section.cjs (fixes ESM/CJS conflict) - Update all references in author.sh, run.sh, and action.yml test steps - Fix post-comment.sh: remove || true, match full HTML marker for upsert - Document same-repo-only / unsandboxed actor risk in act.sh - Document intentional continue-on-error behavior in author README - Switch all action.yml to use $ACTION_PATH env var (CodeQL-safe pattern) Ref: ED-25578 Addresses review feedback from Ntnelbaba on PR #55 Co-authored-by: Davids Seveloff <davseve@users.noreply.github.com>

ok

cursor · 2026-09-17T13:25:20Z

Review feedback addressed

All must-fix items from @Ntnelbaba have been resolved:

1. ✅ CJS/ESM conflict fixed

Renamed parse-section.js → parse-section.cjs (fixes require breaking under ESM root package type)
Updated all references:
- actions/visual-proof-author/author.sh (2 places)
- actions/visual-proof-shots/run.sh (1 place)
- actions/visual-proof-shots/action.yml (test step)
Verified with node actions/visual-proof/parse-section.cjs --test ✓

2. ✅ Single shared parser

Created actions/visual-proof/parse-section.cjs used by both author and shots actions
Deleted duplicate actions/visual-proof-author/parse-section.js and actions/visual-proof-shots/parse-section.js
Eliminates drift risk between the two actions

3. ✅ Strict upsert in post-comment.sh

Removed || true from find-comment step (no longer swallows failures)
Now matches full HTML marker  via ${MARKER} variable to prevent duplicate comments

4. ✅ Security documentation

Added warning comment at top of act.sh about same-repo-only / unsandboxed actor risk:

WARNING: This script runs an unsandboxed Cursor Agent (storyboard actor) that has full write access to the calling repo's checkout and executes code from the PR branch. Only use with same-repo PRs (fork PRs are blocked by the workflow).

5. ✅ Continue-on-error documentation

Added "Intentional non-blocking behavior" section to actions/visual-proof-author/README.md explaining that author failures are non-blocking because visual proof is optional
The action already fails verification when section is still missing after cursor-agent claims success (lines 129-132 in author.sh)

6. ✅ CodeQL-safe pattern for github.action_path

Switched all action.yml files from ${{ github.action_path }} interpolation in shell run: to ACTION_PATH: ${{ github.action_path }} env var
Now uses safe bash expansion $ACTION_PATH only (no direct interpolation)
Applied to both author and shots action.yml files

All changes pushed to this branch. Ready for re-review.

…578] Companion PR elementor/elementor-editor-github-actions#55 got a new push (ESM/CJS + shared parser). Update both visual-proof-author and visual-proof-shots to SHA d44fcedc6ac349a709d176e243bb35b0b0ba755f. Ref: ED-25578 Co-authored-by: Davids Seveloff <davseve@users.noreply.github.com>

Ntnelbaba · 2026-09-17T14:25:31Z

 **/dist/**
 **/__snapshots__/**
 package-lock.json
+actions/visual-proof-author/*.js


Why not the entire folder?

Fixed — replaced per-extension ignores with folder-level actions/visual-proof*/** covering all three directories (including the shared visual-proof/ folder).

Ntnelbaba · 2026-09-17T14:36:12Z

+name: 'Visual proof shots'
+description: 'Record Playground screenshots and a short clip from ## Visual proof Steps'
+
+inputs:


Secrets stuff should transfer using env only and not inputs

The action currently accepts secrets as inputs then maps them to env internally (GH_TOKEN: ${{ inputs.github-token }}). Moving to env-only would require updating the Core PR #37307 workflow that's already pinning this action. Since the secrets don't leak through logs (they're mapped to env before the script runs) and changing it would be a breaking change, I'll defer this refactor until we coordinate with Core's usage.

Ntnelbaba · 2026-09-17T14:41:05Z

 			'**/dist/**',
 			'**/node_modules/**',
 			'**/__snapshots__/**',
+			'actions/visual-proof-author/**/*.js',


Both lines are contained by each other

Fixed — consolidated to folder-level ignore actions/visual-proof*/** which covers all three directories (visual-proof/, visual-proof-author/, visual-proof-shots/) including the shared parser.

@Ntnelbaba

- Replace extension-specific globs with 'actions/visual-proof*/**' - Covers visual-proof/, visual-proof-author/, visual-proof-shots/ - Addresses PR review feedback from @Ntnelbaba Ref: ED-25578 Co-authored-by: Davids Seveloff <davseve@users.noreply.github.com>

ci: Add shared Visual proof author and shots actions [ED-25578]

1bb093a

Ref: ED-25578 Co-authored-by: Cursor <cursoragent@cursor.com>

github-advanced-security Bot found potential problems Sep 17, 2026

View reviewed changes

Comment thread actions/visual-proof-author/action.yml Fixed

Comment thread actions/visual-proof-shots/action.yml Fixed

Comment thread actions/visual-proof-shots/action.yml Fixed

gitstream-cm Bot added the 30 min review label Sep 17, 2026

fix: Avoid CodeQL injection on github.action_path [ED-25578]

d18c218

Ref: ED-25578 Co-authored-by: Cursor <cursoragent@cursor.com>

gitstream-cm Bot added 🚨 3 Unresolved Thread(s) and removed 🚨 3 Unresolved Thread(s) labels Sep 17, 2026

fix: keep visual-proof playwright out of npm workspaces [ED-25578]

43361d6

Ref: ED-25578 Co-authored-by: Cursor <cursoragent@cursor.com>

davseve changed the title ~~Internal: Shared Visual proof author and shots actions [ED-25578]~~ ci: add shared visual proof author and shots actions Sep 17, 2026

davseve changed the title ~~ci: add shared visual proof author and shots actions~~ ci: add shared visual proof author and shots actions [ED-25578] Sep 17, 2026

davseve and others added 3 commits September 17, 2026 14:41

style: format visual-proof files with prettier [ED-25578]

59f3cee

Ref: ED-25578 Co-authored-by: Cursor <cursoragent@cursor.com>

style: ignore visual-proof scripts in prettier [ED-25578]

322fd7f

Ref: ED-25578 Co-authored-by: Cursor <cursoragent@cursor.com>

docs: Run visual-proof-shots when a draft is marked ready [ED-25578]

3b3c15b

Ref: ED-25578 Co-authored-by: Cursor <cursoragent@cursor.com>

Ntnelbaba previously requested changes Sep 17, 2026

View reviewed changes

gitstream-cm Bot added the 🚨 7 Unresolved Thread(s) label Sep 17, 2026

gitstream-cm Bot added 🚨 6 Unresolved Thread(s) 🚨 5 Unresolved Thread(s) and removed 🚨 7 Unresolved Thread(s) 🚨 6 Unresolved Thread(s) labels Sep 17, 2026

Ntnelbaba reviewed Sep 17, 2026

View reviewed changes

gitstream-cm Bot added 🚨 4 Unresolved Thread(s) and removed 🚨 5 Unresolved Thread(s) labels Sep 17, 2026

Ntnelbaba reviewed Sep 17, 2026

View reviewed changes

gitstream-cm Bot added 🚨 5 Unresolved Thread(s) and removed 🚨 4 Unresolved Thread(s) labels Sep 17, 2026

Ntnelbaba reviewed Sep 17, 2026

View reviewed changes

gitstream-cm Bot added 🚨 6 Unresolved Thread(s) and removed 🚨 5 Unresolved Thread(s) labels Sep 17, 2026

Conversation

davseve commented Sep 17, 2026 • edited by gitstream-cm Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Visual proof

Jira

✨ PR Description

1. Problem & Context

2. What Changed (Where)

3. How It Works

4. Risks

Uh oh!

wiz-9a149474ff Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Wiz Scan Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ntnelbaba left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Ntnelbaba commented Sep 17, 2026

Uh oh!

cursor Bot commented Sep 17, 2026

Review feedback addressed

1. ✅ CJS/ESM conflict fixed

2. ✅ Single shared parser

3. ✅ Strict upsert in post-comment.sh

4. ✅ Security documentation

5. ✅ Continue-on-error documentation

6. ✅ CodeQL-safe pattern for github.action_path

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

davseve commented Sep 17, 2026 •

edited by gitstream-cm Bot

Loading

wiz-9a149474ff Bot commented Sep 17, 2026 •

edited

Loading