feat: preview workflows by felipefreitag · Pull Request #866 · resend/resend-node

felipefreitag · 2026-03-04T17:13:46Z

No description provided.

pkg-pr-new · 2026-03-04T17:14:47Z

npm i https://pkg.pr.new/resend@866

commit: 8761da8

cubic-dev-ai

4 issues found across 25 files

Confidence score: 3/5

There’s some meaningful merge risk: src/events/events.spec.ts adds new Resend Events/workflow SDK operations without explicit confirmation of required production API-key permissions, which can lead to authorization failures or policy non-compliance after release.
src/workflows/workflows.spec.ts and src/events/events.spec.ts include API-key-like hardcoded token strings in tests; even in test artifacts, this is a security hygiene concern and should be replaced with redacted placeholders before merging.
In src/events/events.spec.ts, a test retrieves data without asserting it, so regressions in events.get response handling may slip through undetected.
Pay close attention to src/events/events.spec.ts and src/workflows/workflows.spec.ts - permission-check compliance and token redaction need to be resolved to reduce risk.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/events/events.spec.ts">

<violation number="1" location="src/events/events.spec.ts:15">
P2: Avoid committing raw API tokens in tests; use a redacted placeholder value instead.

(Based on your team's feedback about redacting secrets from test artifacts.) [FEEDBACK_USED]</violation>

<violation number="2" location="src/events/events.spec.ts:131">
P1: Custom agent: **API Key Permission Check SDK Methods**

Rule 1 (API Key Permission Check SDK Methods) is violated: this PR introduces new Resend Events/workflow SDK operations without an explicit confirmation that production API keys have the required permissions for these endpoints. Add a permission-scope verification note/check before release to avoid runtime authorization failures.</violation>

<violation number="3" location="src/events/events.spec.ts:257">
P2: The test fetches `data` but never asserts it, so regressions in `events.get` response handling can pass unnoticed.</violation>
</file>

<file name="src/workflows/workflows.spec.ts">

<violation number="1" location="src/workflows/workflows.spec.ts:17">
P2: Do not commit API-key-like secrets in test code; replace hardcoded token strings with a redacted dummy/test value.

(Based on your team's feedback about redacting secrets from test artifacts.) [FEEDBACK_USED]</violation>
</file>

Since this is your first cubic review, here's how it works:

cubic automatically reviews your code and comments on bugs and improvements
Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
Add one-off context when rerunning by tagging @cubic-dev-ai with guidance or docs links (including llms.txt)
Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-03-04T17:16:47Z

src/events/events.spec.ts

+        },
+      });
+
+      const data = await resend.events.create({


P1: Custom agent: API Key Permission Check SDK Methods

Rule 1 (API Key Permission Check SDK Methods) is violated: this PR introduces new Resend Events/workflow SDK operations without an explicit confirmation that production API keys have the required permissions for these endpoints. Add a permission-scope verification note/check before release to avoid runtime authorization failures.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/events/events.spec.ts, line 131: <comment>Rule 1 (API Key Permission Check SDK Methods) is violated: this PR introduces new Resend Events/workflow SDK operations without an explicit confirmation that production API keys have the required permissions for these endpoints. Add a permission-scope verification note/check before release to avoid runtime authorization failures.</comment> <file context> @@ -0,0 +1,421 @@ + }, + }); + + const data = await resend.events.create({ + name: 'user.created', + schema: { name: 'string', age: 'number' }, </file context>

cubic-dev-ai · 2026-03-04T17:16:47Z

src/workflows/workflows.spec.ts

+const fetchMocker = createFetchMock(vi);
+fetchMocker.enableMocks();
+
+const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop');


P2: Do not commit API-key-like secrets in test code; replace hardcoded token strings with a redacted dummy/test value.

(Based on your team's feedback about redacting secrets from test artifacts.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/workflows/workflows.spec.ts, line 17: <comment>Do not commit API-key-like secrets in test code; replace hardcoded token strings with a redacted dummy/test value. (Based on your team's feedback about redacting secrets from test artifacts.) </comment> <file context> @@ -0,0 +1,409 @@ +const fetchMocker = createFetchMock(vi); +fetchMocker.enableMocks(); + +const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop'); + +describe('Workflows', () => { </file context>

cubic-dev-ai · 2026-03-04T17:16:47Z

src/events/events.spec.ts

+const fetchMocker = createFetchMock(vi);
+fetchMocker.enableMocks();
+
+const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop');


P2: Avoid committing raw API tokens in tests; use a redacted placeholder value instead.

(Based on your team's feedback about redacting secrets from test artifacts.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/events/events.spec.ts, line 15: <comment>Avoid committing raw API tokens in tests; use a redacted placeholder value instead. (Based on your team's feedback about redacting secrets from test artifacts.) </comment> <file context> @@ -0,0 +1,421 @@ +const fetchMocker = createFetchMock(vi); +fetchMocker.enableMocks(); + +const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop'); + +describe('Events', () => { </file context>

src/events/events.spec.ts

cubic-dev-ai

2 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/workflow-runs/workflow-runs.spec.ts">

<violation number="1" location="src/workflow-runs/workflow-runs.spec.ts:41">
P2: Avoid hardcoding token-like API keys in tests; use an obviously redacted/dummy value instead.

(Based on your team's feedback about redacting secrets in test artifacts.) [FEEDBACK_USED]</violation>
</file>

<file name="src/workflow-runs/workflow-runs.ts">

<violation number="1" location="src/workflow-runs/workflow-runs.ts:18">
P1: Custom agent: **API Key Permission Check SDK Methods**

This PR adds new Workflow Runs SDK operations (`get`/`list`) but does not include a permission-check reminder/handling path for API keys. Per the API Key Permission Check SDK Methods rule, confirm production API keys have scopes for these new `/workflows/*/runs` operations to prevent permission-related runtime failures.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-03-05T19:53:07Z

src/workflow-runs/workflow-runs.ts

+  constructor(private readonly resend: Resend) {}
+
+  async get(options: GetWorkflowRunOptions): Promise<GetWorkflowRunResponse> {
+    const data = await this.resend.get<GetWorkflowRunResponseSuccess>(


P1: Custom agent: API Key Permission Check SDK Methods

This PR adds new Workflow Runs SDK operations (get/list) but does not include a permission-check reminder/handling path for API keys. Per the API Key Permission Check SDK Methods rule, confirm production API keys have scopes for these new /workflows/*/runs operations to prevent permission-related runtime failures.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/workflow-runs/workflow-runs.ts, line 18: <comment>This PR adds new Workflow Runs SDK operations (`get`/`list`) but does not include a permission-check reminder/handling path for API keys. Per the API Key Permission Check SDK Methods rule, confirm production API keys have scopes for these new `/workflows/*/runs` operations to prevent permission-related runtime failures.</comment> <file context> @@ -0,0 +1,35 @@ + constructor(private readonly resend: Resend) {} + + async get(options: GetWorkflowRunOptions): Promise<GetWorkflowRunResponse> { + const data = await this.resend.get<GetWorkflowRunResponseSuccess>( + `/workflows/${options.workflowId}/runs/${options.runId}`, + ); </file context>

cubic-dev-ai · 2026-03-05T19:53:07Z

src/workflow-runs/workflow-runs.spec.ts

+
+      mockSuccessResponse(response, {});
+
+      const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop');


P2: Avoid hardcoding token-like API keys in tests; use an obviously redacted/dummy value instead.

(Based on your team's feedback about redacting secrets in test artifacts.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/workflow-runs/workflow-runs.spec.ts, line 41: <comment>Avoid hardcoding token-like API keys in tests; use an obviously redacted/dummy value instead. (Based on your team's feedback about redacting secrets in test artifacts.) </comment> <file context> @@ -0,0 +1,190 @@ + + mockSuccessResponse(response, {}); + + const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop'); + await expect( + resend.workflows.runs.get(options), </file context>

cubic-dev-ai

2 issues found across 10 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/workflow-run-steps/workflow-run-steps.ts">

<violation number="1" location="src/workflow-run-steps/workflow-run-steps.ts:21">
P1: Custom agent: **API Key Permission Check SDK Methods**

This PR adds new SDK methods that call workflow run step endpoints. Please confirm that the existing production API keys are provisioned with the required permissions for these new workflow run step read operations to avoid permission failures after deployment.</violation>
</file>

<file name="src/workflow-run-steps/workflow-run-steps.spec.ts">

<violation number="1" location="src/workflow-run-steps/workflow-run-steps.spec.ts:46">
P2: Avoid hardcoding API keys in test code; use a redacted placeholder or environment variable to prevent credential leakage.

(Based on your team's feedback about redacting secrets from test recordings/cassettes even if ephemeral.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-03-05T20:24:00Z

src/workflow-run-steps/workflow-run-steps.ts

+    options: GetWorkflowRunStepOptions,
+  ): Promise<GetWorkflowRunStepResponse> {
+    const data = await this.resend.get<GetWorkflowRunStepResponseSuccess>(
+      `/workflows/${options.workflowId}/runs/${options.runId}/steps/${options.stepId}`,


P1: Custom agent: API Key Permission Check SDK Methods

This PR adds new SDK methods that call workflow run step endpoints. Please confirm that the existing production API keys are provisioned with the required permissions for these new workflow run step read operations to avoid permission failures after deployment.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/workflow-run-steps/workflow-run-steps.ts, line 21: <comment>This PR adds new SDK methods that call workflow run step endpoints. Please confirm that the existing production API keys are provisioned with the required permissions for these new workflow run step read operations to avoid permission failures after deployment.</comment> <file context> @@ -0,0 +1,38 @@ + options: GetWorkflowRunStepOptions, + ): Promise<GetWorkflowRunStepResponse> { + const data = await this.resend.get<GetWorkflowRunStepResponseSuccess>( + `/workflows/${options.workflowId}/runs/${options.runId}/steps/${options.stepId}`, + ); + return data; </file context>

cubic-dev-ai · 2026-03-05T20:24:00Z

src/workflow-run-steps/workflow-run-steps.spec.ts

+
+      mockSuccessResponse(response, {});
+
+      const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop');


P2: Avoid hardcoding API keys in test code; use a redacted placeholder or environment variable to prevent credential leakage.

(Based on your team's feedback about redacting secrets from test recordings/cassettes even if ephemeral.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/workflow-run-steps/workflow-run-steps.spec.ts, line 46: <comment>Avoid hardcoding API keys in test code; use a redacted placeholder or environment variable to prevent credential leakage. (Based on your team's feedback about redacting secrets from test recordings/cassettes even if ephemeral.) </comment> <file context> @@ -0,0 +1,207 @@ + + mockSuccessResponse(response, {}); + + const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop'); + await expect( + resend.workflows.runs.steps.get(options), </file context>

cubic-dev-ai

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/workflows/interfaces/workflow-step.interface.ts">

<violation number="1" location="src/workflows/interfaces/workflow-step.interface.ts:82">
P3: `WorkflowStepType` duplicates the literal step-type list already defined by `WorkflowStep`, creating a drift risk. Derive it from `WorkflowStep['type']` to keep a single source of truth.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

src/workflows/interfaces/workflow-step.interface.ts

felipefreitag added 5 commits March 3, 2026 13:48

feat: workflows

5b321fa

chore: bump version

584b288

feat: add events and patch workflow

c563edb

fix: update workflow create response

5e3020b

fix: update event schema validation

dce517e

felipefreitag requested a review from a team as a code owner March 4, 2026 17:13

felipefreitag requested a review from vcapretz March 4, 2026 17:13

felipefreitag changed the title ~~feat: Preview workflows~~ feat: preview workflows Mar 4, 2026

cubic-dev-ai bot reviewed Mar 4, 2026

View reviewed changes

fix: linter

97623e4

felipefreitag closed this Mar 4, 2026

felipefreitag reopened this Mar 4, 2026

felipefreitag added the do not merge label Mar 4, 2026

felipefreitag added 2 commits March 4, 2026 15:49

fix: update types

0e3551a

feat: add workflow runs list and details

948486d

cubic-dev-ai bot reviewed Mar 5, 2026

View reviewed changes

feat: add workflow run steps

a21f194

cubic-dev-ai bot reviewed Mar 5, 2026

View reviewed changes

felipefreitag added 3 commits March 5, 2026 17:40

fix: remove implementation details

852a180

feat: add steps payload

5d85303

feat: improve workflow types

d438ef7

cubic-dev-ai bot reviewed Mar 6, 2026

View reviewed changes

src/workflows/interfaces/workflow-step.interface.ts Outdated Show resolved Hide resolved

felipefreitag added 5 commits March 6, 2026 16:45

chore: bump package

c156244

fix:lint

e92581b

fix: types

d661e13

fix: remove type repetition

1defc60

fix: lint

fbcd35d


		mockSuccessResponse(response, {});

		const resend = new Resend('re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop');

Conversation

felipefreitag commented Mar 4, 2026

Uh oh!

pkg-pr-new bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pkg-pr-new bot commented Mar 4, 2026 •

edited

Loading