Cristian Calina

ci(ci): extract inline workflow scripts into .github/scripts Move ~500 lines of YAML-embedded JavaScript into 11 standalone .mjs modules so workflow steps are 2-3 line stubs and the logic is readable, reviewable, and testable: - lib/pr-comments.mjs: the marker-comment find/upsert/remove pattern, written once and shared by every workflow that owns a PR comment (preview deploys, visual diff, dependency license review, support branch scope) - preview-deploy/: init/update preview table, visual diff comment, derive-app-url (was a heredoc duplicated in two steps), summary counts - pr-size-labels.mjs: label set + sizing logic in one place; the prepare-config job existed only to ship that config between jobs as a JSON output and is gone - also extracted: find-size-baseline (pr-checks), registry matrix batches (apollo-vertex-registry-check) Comment lookups in dependency-review and support-branch-scope now paginate and filter by bot author like the rest (previously any user pasting the marker could hijack the comment slot), and dependency-review no longer interpolates runner.temp inside the script. Jobs that ran pure github-script gained a sparse .github/scripts checkout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

feat(apollo-ui-icons): add the Maestro product marks with flat variants Adds maestro-case, maestro-flow, maestro-automate and maestro-bpmn from the "Maestro Icon Updates - Sep 2026" Figma file, each in the two-tone form design specified plus a `-flat` variant. The accent sparkle paints with `var(--color-primary)` rather than the literal `#0067df` the Figma export carries, so it resolves per theme — #66adff on dark, #00489d on light-hc — instead of sitting at the light-theme blue on every surface. The `-flat` variants drop the second colour entirely, every path on `currentColor`, for surfaces that tint the whole mark; this follows the existing agent-desktop-logo / agent-desktop-logo-flat pair. Generated output comes from the package's own pipeline: 1330 icons, 1330 unique names, `update-colors` a no-op afterwards, 103/103 tests passing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

feat(apollo-ui-icons): ship the Apollo icon set as its own package [PLT-109649] Moves the icon set and its four build scripts out of apollo-core into @uipath/apollo-ui-icons. All 1322 SVGs are byte-identical moves; the only content edits are the script path constants and the usage comment in the generated index. This unblocks building apollo-core bundleless. Bundle mode there emitted a shared `rslib-runtime.js` whose `export { __webpack_require__ }` made consumers' production builds panic in rspack, and bundleless was impossible while the icons lived in the package: rslib skips the asset pipeline in that mode, which left every `icons/index.js` import unresolvable and `dist/static/svg/` empty. The name @uipath/apollo-icons was unavailable — apollo-design-system publishes it at 1.33.7 as a fantasticon webfont with 14 live consumers, so reusing it would mean two repos publishing one name and an entry point that changed kind. Hence apollo-ui-icons, after the repo it lives in. Two entries, each compiled separately by rslib: the root re-exports every icon, and ./types carries IconName and iconNames so consumers that only need the names never pull the SVG graph in. Registered in the release pipeline (tar, SBOM, provenance attestation), the publish monitor, the PR labeler, and the commitlint scope list. Lint stays scoped to src, matching what apollo-core linted before the move, so the pre-existing violations in the scripts are not in scope here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs(repo): place apollo-ui-icons in the dependency graphs and guides [PLT-109649] Adds the package to the README mermaid graph, the apollo-docs dependency graph and installation tabs, the Storybook introduction, and the repository structure trees. apollo-core's own docs now describe tokens and fonts, with its two icon paths marked deprecated. The graphs show apollo-react depending on the icon package directly and apollo-core only re-exporting it, so the deprecation is visible where people look first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

feat(apollo-wind): scrollable tabs, per-tab error badges, plain sections in MetadataForm Adapts the tabbed MetadataForm (properties-panel form) for narrow panels, surfaces validation state on the tab strip, and adds a borderless section treatment for hosts that frame the panel themselves. apollo-wind (metadata-form): - Scrollable tab strip: TabbedStepForm uses ScrollableTabsList, revealing prev/next chevrons and auto-scrolling the active tab into view when tabs overflow a narrow panel. A wide panel reads identically to a plain strip. - Per-tab error badges: each tab shows a live count of its errored fields (via useFormState), including fields on inactive tabs. Composite fields whose error is an array contribute one per issue. Conditionally-hidden sections AND individually-hidden fields are skipped so a badge never points at something the user cannot reach. The badge is exposed to assistive tech as "N issue(s)". - sectionVariant 'card' | 'plain': 'plain' drops the border, rounding, and horizontal padding so sections read as flush semibold headers over their content, separated by a full-width hairline divider between consecutive sections, for hosts (e.g. the canvas properties panel) that already frame the form. Applies to collapsible, non-collapsible, and titleless sections. - Adds a SectionVariants story with a live card/plain toggle, covering titled collapsible sections and sole untitled sections (the consumer's two shapes). apollo-react: - NodePropertyPanel forwards a sectionVariant prop through to MetadataForm. Tests: pnpm --filter @uipath/apollo-wind test, 987 pass (incl. inactive-tab badge and composite-array issue count). biome and tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(apollo-wind): always-shown tabs with empty-state + controlled active tab - FormStep.emptyState: a tabbed step with no visible sections stays in the tab bar and renders the message instead of being hidden (e.g. an always-present Parameters tab reading "No available parameters"). - MetadataForm/TabbedStepForm: controlled activeStepId + onActiveStepChange so a host can persist the selected tab across remounts (keep the same tab when switching nodes); clamps to the first tab when the id isn't present. - NodePropertyPanel threads both props through to MetadataForm. - Plain-section divider: bump vertical spacing 12px -> 16px. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci(ci): add storybook visual diff check to preview deployments Compare each PR's apollo-design preview Storybook against the deployed main Storybook with @uipath/storybook-visual-diff and post the result as an informational PR comment (never merge-blocking): - visual-diff job in preview-deploy.yml: waits for the deploy matrix, reads the apollo-design leg's result artifact, runs sbdiff scoped via git diff origin/main...HEAD, and treats exit 0/1 (clean/changes) both as valid outcomes - when changes are found, the report (prebuilt sbdiff viewer + summary.json + images) deploys as the apollo-design-diff-pr-<N> Coded App via the new build-less .uip-go.json recipe, and the PR comment links it with changed/added/removed/errored counts - report app is cleaned up on PR close alongside the other previews Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ci(repo): fail the release when a publish misses npmjs.org [PLT-109649] `pnpm publish` exits 0 in cases where nothing reaches npmjs.org at all. When the OIDC token exchange fails — which it does for any package with no Trusted Publisher on npmjs.com, and a new package cannot have one before it exists — pnpm logs "Skipped OIDC", silently falls back to the ambient registry (GHP), publishes there and still succeeds. `set -euo pipefail` never fires, and the script prints "✓ Published to npm.org". That is not hypothetical. @uipath/apollo-ui-icons@1.0.0 went only to GHP; the intended GHP step then hit a 409 against what the previous line had just published, which read as an unrelated registry conflict. The next release skipped the package (its tag existed by then) and shipped @uipath/apollo-core@5.13.0 and @uipath/apollo-react@6.23.1 to npmjs.org depending on a package that was not there, so `npm install` of either failed with E404 for every consumer until the missing package was published by hand. Two guards, after the npm.org publish: - Treat "Skipped OIDC" as fatal, naming the package and what to configure. - Ask the registry whether the version is actually retrievable. This is outcome-based, so it also catches a wrong registry, a no-op publish or a revoked publisher — not just the one symptom we happened to observe. It polls the version document rather than the packument, because a brand-new package name stays 404 on the packument for minutes after the version endpoint is live. Also fixes the same class of bug in the monitor: it queried npmjs.org with a plain `--registry`, which does not override a scoped `@uipath:registry`. It works today only because the repo .npmrc deliberately omits that line — if a runner ever picks one up, the audit would silently read GHP and report everything healthy. Verified: shellcheck clean; the guard detects the exact CI output that was missed and does not fire on a clean log; the retrieval check finds apollo-ui-icons@1.0.0 and apollo-core@5.13.0 and correctly rejects a version that does not exist; pipefail still propagates a failing publish through tee. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

fix(apollo-ui-icons): stop pinning the package to GitHub Packages [PLT-109649] publishConfig.registry has been on this package since it was created, and it outranks the --@uipath:registry flags that publish-to-registries.sh uses to switch registries. Both passes therefore targeted npm.pkg.github.com: the "npm.org" pass published there and printed "✓ Published to npm.org", then the GitHub Packages pass died on a 409 against the version it had just written. That is the whole failure, and it is not new. The same thing happened at 1.0.0; a46753282 read it as "published to both registries then 409'd", but npm's 1.0.0 carries no dist.attestations and was published by hand. CI has never published this package to npm. The OIDC 404s in the logs are the same bug seen from the other side: pnpm asked npm's token exchange for audience npm:npm.pkg.github.com because it believed the registry was GitHub Packages. Verified with the same pnpm 11.1.3 build CI runs: with the field, the npm pass resolves to npm.pkg.github.com; without it, registry.npmjs.org, matching what apollo-wind and apollo-core already do. The script now refuses to run when a package pins publishConfig.registry. A misroute here reported success, so it survived a month and two releases without anyone noticing. Failing closed is what was missing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

feat(apollo-react): forward autoComplete through NodePropertyPanel MetadataForm already accepts autoComplete and applies it to its <form> element, but NodePropertyPanel did not expose it, so hosts embedding the panel could not disable browser autofill. Autofill dropdowns cover fields whose names match common autofill categories (label, url, description). Add an autoComplete prop ('off' | 'on') and forward it to the underlying MetadataForm in both the tabbed (multi-step) and single-page branches. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>