ci(repo): dogfood snapi api checks

[jacekradko]

Stands up snapi API-change detection for backend, clerk-js, nextjs, react, shared, and ui. On push to main and the release branches a publish-baseline job writes the snapshot to a sha-keyed GHA cache; PR runs restore from it, falling back to rebuilding from a worktree at pull_request.base.sha on a full miss. Snapi itself is pulled from pkg.pr.new because clerk/snapi is private.

continue-on-error: true on the job keeps the workflow non-blocking while we shake it out.

Here is an example PR with breaking changes in clerk/snapi: clerk/break-check#21

Here is a sample of a breaking-change report:

[changeset-bot]

🦋 Changeset detected

Latest commit: a182d1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 27, 2026 3:44pm

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds SNAPI-based API change detection: a new snapi.config.json lists four packages to scan and snapshot settings; a GitHub Actions workflow (api-changes.yml) now runs on push and pull_request for main and release branches, adds a publish-baseline job for push that builds declarations and caches baseline snapshots, and reworks the check-api job for PRs to restore or build baseline snapshots, run snapi detect (failing on breaking changes), and upload api-changes-report.md. The UI package gains a declarations-only tsconfig and a build:declarations script. A changeset entry was updated.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci(repo): dogfood snapi api checks' clearly and concisely describes the main change—setting up the snapi API-checks workflow for testing purposes in the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description clearly explains the purpose of the changes: setting up snapi API-change detection for multiple packages with a GitHub Actions workflow that uses caching and fallback mechanisms.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Line 67: The workflow generates current snapshots to ".api-snapshots-current"
but snapi.config.json uses snapshotDir ".api-snapshots", so update the pnpm dlx
snapi snapshot invocation or the snapi.detect invocation to use the same
directory: either change the snapshot command (the run line that calls "pnpm dlx
--package \"$SNAPI_PACKAGE\" snapi snapshot --output .api-snapshots-current") to
output to ".api-snapshots" or pass the explicit --current flag/--output value to
the "snapi detect" step so it points at ".api-snapshots-current", ensuring the
snapshot generation and detection commands reference the same directory.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9f43cc8f-f375-42fc-a605-7463dfc82b40

📥 Commits

Reviewing files that changed from the base of the PR and between 2f003bc and 741ad85.

📒 Files selected for processing (3)

• .changeset/dogfood-snapi.md
• .github/workflows/api-changes.yml
• snapi.config.json

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8621

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8621

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8621

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8621

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8621

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8621

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8621

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8621

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8621

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8621

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8621

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8621

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8621

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8621

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8621

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8621

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8621

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8621

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8621

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8621

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8621

commit: a182d1c

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 124-127: The fallback fetch uses a moving ref
(origin/${GITHUB_BASE_REF}) which can drift; change the git fetch invocation(s)
that currently use GITHUB_BASE_REF to fetch the immutable PR base SHA
(github.event.pull_request.base.sha) instead so the fallback baseline matches
the PR base commit; update both occurrences of the fetch command in the workflow
to use the PR base SHA when populating refs/remotes/origin/${GITHUB_BASE_REF}.
- Around line 57-61: Update the workflow steps that use actions to pin their
versions to specific commit SHAs and disable persisted credentials: replace both
uses of actions/checkout@v4 (the "Checkout Repo" steps) with the corresponding
actions/checkout@<commit-sha> and add persist-credentials: false under their
with blocks; likewise replace actions/cache/save@v4 and actions/cache/restore@v4
with their pinned commit SHAs (actions/cache/save@<commit-sha>,
actions/cache/restore@<commit-sha>). Ensure you only change the version
specifiers and add the persist-credentials: false key to the checkout steps
while keeping existing keys like filter and show-progress intact.
- Around line 112-120: The baseline cache restore step (id baseline-cache using
actions/cache/restore@v4) must gate rebuilds on an exact cache hit, not partial
matches: change the rebuild condition to check
steps.baseline-cache.outputs.cache-hit != 'true' so any non-exact hit (including
partial matches) triggers the rebuild; when rebuilding, ensure the checkout used
to create the baseline worktree checks out the immutable PR base SHA (use ref:
${{ github.event.pull_request.base.sha }} or GITHUB event value) instead of
GITHUB_BASE_REF; set persist-credentials: false on both actions/checkout steps
to avoid leaking tokens; and pin external actions (actions/cache,
actions/checkout, etc.) to specific commit SHAs instead of floating `@v4` tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: c19b2a18-6732-4ac4-a1ee-d17aff1504ca

📥 Commits

Reviewing files that changed from the base of the PR and between dd6e886 and 7b226d2.

📒 Files selected for processing (4)

• .github/workflows/api-changes.yml
• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

✅ Files skipped from review due to trivial changes (3)

• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 138-139: The workflow currently copies the entire
packages/ui/package.json into .worktrees/snapi-baseline/packages/ui/package.json
which imports PR-head manifest changes; instead update only the
scripts.build:declarations entry in the baseline package.json. In the
.github/workflows/api-changes.yml replace the two cp commands that reference
packages/ui/package.json and .worktrees/snapi-baseline/packages/ui/package.json
with a command that reads packages/ui/package.json, extracts the
"build:declarations" script, and patches
.worktrees/snapi-baseline/packages/ui/package.json to set
.scripts["build:declarations"] to that value (preserving all other fields).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: cc276cc0-8fbe-4284-9389-6221b9dcb1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 7b226d2 and b54cb52.

📒 Files selected for processing (1)

• .github/workflows/api-changes.yml

[jacekradko]

Stands up snapi API-change detection for backend, clerk-js, nextjs, react, shared, and ui. On push to main and the release branches a publish-baseline job writes the snapshot to a sha-keyed GHA cache; PR runs restore from it, falling back to rebuilding from a worktree at pull_request.base.sha on a full miss. Snapi itself is pulled from pkg.pr.new because clerk/snapi is private.

continue-on-error: true on the job keeps the workflow non-blocking while we shake it out.

Here is an example PR with breaking changes in clerk/snapi: clerk/break-check#21

Here is a sample of a breaking-change report:

[changeset-bot]

🦋 Changeset detected

Latest commit: a182d1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 27, 2026 3:44pm

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds SNAPI-based API change detection: a new snapi.config.json lists four packages to scan and snapshot settings; a GitHub Actions workflow (api-changes.yml) now runs on push and pull_request for main and release branches, adds a publish-baseline job for push that builds declarations and caches baseline snapshots, and reworks the check-api job for PRs to restore or build baseline snapshots, run snapi detect (failing on breaking changes), and upload api-changes-report.md. The UI package gains a declarations-only tsconfig and a build:declarations script. A changeset entry was updated.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci(repo): dogfood snapi api checks' clearly and concisely describes the main change—setting up the snapi API-checks workflow for testing purposes in the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description clearly explains the purpose of the changes: setting up snapi API-change detection for multiple packages with a GitHub Actions workflow that uses caching and fallback mechanisms.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Line 67: The workflow generates current snapshots to ".api-snapshots-current"
but snapi.config.json uses snapshotDir ".api-snapshots", so update the pnpm dlx
snapi snapshot invocation or the snapi.detect invocation to use the same
directory: either change the snapshot command (the run line that calls "pnpm dlx
--package \"$SNAPI_PACKAGE\" snapi snapshot --output .api-snapshots-current") to
output to ".api-snapshots" or pass the explicit --current flag/--output value to
the "snapi detect" step so it points at ".api-snapshots-current", ensuring the
snapshot generation and detection commands reference the same directory.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9f43cc8f-f375-42fc-a605-7463dfc82b40

📥 Commits

Reviewing files that changed from the base of the PR and between 2f003bc and 741ad85.

📒 Files selected for processing (3)

• .changeset/dogfood-snapi.md
• .github/workflows/api-changes.yml
• snapi.config.json

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8621

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8621

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8621

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8621

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8621

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8621

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8621

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8621

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8621

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8621

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8621

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8621

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8621

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8621

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8621

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8621

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8621

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8621

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8621

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8621

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8621

commit: a182d1c

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 124-127: The fallback fetch uses a moving ref
(origin/${GITHUB_BASE_REF}) which can drift; change the git fetch invocation(s)
that currently use GITHUB_BASE_REF to fetch the immutable PR base SHA
(github.event.pull_request.base.sha) instead so the fallback baseline matches
the PR base commit; update both occurrences of the fetch command in the workflow
to use the PR base SHA when populating refs/remotes/origin/${GITHUB_BASE_REF}.
- Around line 57-61: Update the workflow steps that use actions to pin their
versions to specific commit SHAs and disable persisted credentials: replace both
uses of actions/checkout@v4 (the "Checkout Repo" steps) with the corresponding
actions/checkout@<commit-sha> and add persist-credentials: false under their
with blocks; likewise replace actions/cache/save@v4 and actions/cache/restore@v4
with their pinned commit SHAs (actions/cache/save@<commit-sha>,
actions/cache/restore@<commit-sha>). Ensure you only change the version
specifiers and add the persist-credentials: false key to the checkout steps
while keeping existing keys like filter and show-progress intact.
- Around line 112-120: The baseline cache restore step (id baseline-cache using
actions/cache/restore@v4) must gate rebuilds on an exact cache hit, not partial
matches: change the rebuild condition to check
steps.baseline-cache.outputs.cache-hit != 'true' so any non-exact hit (including
partial matches) triggers the rebuild; when rebuilding, ensure the checkout used
to create the baseline worktree checks out the immutable PR base SHA (use ref:
${{ github.event.pull_request.base.sha }} or GITHUB event value) instead of
GITHUB_BASE_REF; set persist-credentials: false on both actions/checkout steps
to avoid leaking tokens; and pin external actions (actions/cache,
actions/checkout, etc.) to specific commit SHAs instead of floating `@v4` tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: c19b2a18-6732-4ac4-a1ee-d17aff1504ca

📥 Commits

Reviewing files that changed from the base of the PR and between dd6e886 and 7b226d2.

📒 Files selected for processing (4)

• .github/workflows/api-changes.yml
• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

✅ Files skipped from review due to trivial changes (3)

• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 138-139: The workflow currently copies the entire
packages/ui/package.json into .worktrees/snapi-baseline/packages/ui/package.json
which imports PR-head manifest changes; instead update only the
scripts.build:declarations entry in the baseline package.json. In the
.github/workflows/api-changes.yml replace the two cp commands that reference
packages/ui/package.json and .worktrees/snapi-baseline/packages/ui/package.json
with a command that reads packages/ui/package.json, extracts the
"build:declarations" script, and patches
.worktrees/snapi-baseline/packages/ui/package.json to set
.scripts["build:declarations"] to that value (preserving all other fields).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: cc276cc0-8fbe-4284-9389-6221b9dcb1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 7b226d2 and b54cb52.

📒 Files selected for processing (1)

• .github/workflows/api-changes.yml

[jacekradko]

Stands up snapi API-change detection for backend, clerk-js, nextjs, react, shared, and ui. On push to main and the release branches a publish-baseline job writes the snapshot to a sha-keyed GHA cache; PR runs restore from it, falling back to rebuilding from a worktree at pull_request.base.sha on a full miss. Snapi itself is pulled from pkg.pr.new because clerk/snapi is private.

continue-on-error: true on the job keeps the workflow non-blocking while we shake it out.

Here is an example PR with breaking changes in clerk/snapi: clerk/break-check#21

Here is a sample of a breaking-change report:

[changeset-bot]

🦋 Changeset detected

Latest commit: a182d1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 27, 2026 3:44pm

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds SNAPI-based API change detection: a new snapi.config.json lists four packages to scan and snapshot settings; a GitHub Actions workflow (api-changes.yml) now runs on push and pull_request for main and release branches, adds a publish-baseline job for push that builds declarations and caches baseline snapshots, and reworks the check-api job for PRs to restore or build baseline snapshots, run snapi detect (failing on breaking changes), and upload api-changes-report.md. The UI package gains a declarations-only tsconfig and a build:declarations script. A changeset entry was updated.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci(repo): dogfood snapi api checks' clearly and concisely describes the main change—setting up the snapi API-checks workflow for testing purposes in the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description clearly explains the purpose of the changes: setting up snapi API-change detection for multiple packages with a GitHub Actions workflow that uses caching and fallback mechanisms.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Line 67: The workflow generates current snapshots to ".api-snapshots-current"
but snapi.config.json uses snapshotDir ".api-snapshots", so update the pnpm dlx
snapi snapshot invocation or the snapi.detect invocation to use the same
directory: either change the snapshot command (the run line that calls "pnpm dlx
--package \"$SNAPI_PACKAGE\" snapi snapshot --output .api-snapshots-current") to
output to ".api-snapshots" or pass the explicit --current flag/--output value to
the "snapi detect" step so it points at ".api-snapshots-current", ensuring the
snapshot generation and detection commands reference the same directory.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9f43cc8f-f375-42fc-a605-7463dfc82b40

📥 Commits

Reviewing files that changed from the base of the PR and between 2f003bc and 741ad85.

📒 Files selected for processing (3)

• .changeset/dogfood-snapi.md
• .github/workflows/api-changes.yml
• snapi.config.json

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8621

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8621

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8621

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8621

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8621

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8621

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8621

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8621

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8621

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8621

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8621

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8621

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8621

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8621

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8621

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8621

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8621

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8621

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8621

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8621

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8621

commit: a182d1c

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 124-127: The fallback fetch uses a moving ref
(origin/${GITHUB_BASE_REF}) which can drift; change the git fetch invocation(s)
that currently use GITHUB_BASE_REF to fetch the immutable PR base SHA
(github.event.pull_request.base.sha) instead so the fallback baseline matches
the PR base commit; update both occurrences of the fetch command in the workflow
to use the PR base SHA when populating refs/remotes/origin/${GITHUB_BASE_REF}.
- Around line 57-61: Update the workflow steps that use actions to pin their
versions to specific commit SHAs and disable persisted credentials: replace both
uses of actions/checkout@v4 (the "Checkout Repo" steps) with the corresponding
actions/checkout@<commit-sha> and add persist-credentials: false under their
with blocks; likewise replace actions/cache/save@v4 and actions/cache/restore@v4
with their pinned commit SHAs (actions/cache/save@<commit-sha>,
actions/cache/restore@<commit-sha>). Ensure you only change the version
specifiers and add the persist-credentials: false key to the checkout steps
while keeping existing keys like filter and show-progress intact.
- Around line 112-120: The baseline cache restore step (id baseline-cache using
actions/cache/restore@v4) must gate rebuilds on an exact cache hit, not partial
matches: change the rebuild condition to check
steps.baseline-cache.outputs.cache-hit != 'true' so any non-exact hit (including
partial matches) triggers the rebuild; when rebuilding, ensure the checkout used
to create the baseline worktree checks out the immutable PR base SHA (use ref:
${{ github.event.pull_request.base.sha }} or GITHUB event value) instead of
GITHUB_BASE_REF; set persist-credentials: false on both actions/checkout steps
to avoid leaking tokens; and pin external actions (actions/cache,
actions/checkout, etc.) to specific commit SHAs instead of floating `@v4` tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: c19b2a18-6732-4ac4-a1ee-d17aff1504ca

📥 Commits

Reviewing files that changed from the base of the PR and between dd6e886 and 7b226d2.

📒 Files selected for processing (4)

• .github/workflows/api-changes.yml
• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

✅ Files skipped from review due to trivial changes (3)

• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 138-139: The workflow currently copies the entire
packages/ui/package.json into .worktrees/snapi-baseline/packages/ui/package.json
which imports PR-head manifest changes; instead update only the
scripts.build:declarations entry in the baseline package.json. In the
.github/workflows/api-changes.yml replace the two cp commands that reference
packages/ui/package.json and .worktrees/snapi-baseline/packages/ui/package.json
with a command that reads packages/ui/package.json, extracts the
"build:declarations" script, and patches
.worktrees/snapi-baseline/packages/ui/package.json to set
.scripts["build:declarations"] to that value (preserving all other fields).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: cc276cc0-8fbe-4284-9389-6221b9dcb1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 7b226d2 and b54cb52.

📒 Files selected for processing (1)

• .github/workflows/api-changes.yml

[jacekradko]

Stands up snapi API-change detection for backend, clerk-js, nextjs, react, shared, and ui. On push to main and the release branches a publish-baseline job writes the snapshot to a sha-keyed GHA cache; PR runs restore from it, falling back to rebuilding from a worktree at pull_request.base.sha on a full miss. Snapi itself is pulled from pkg.pr.new because clerk/snapi is private.

continue-on-error: true on the job keeps the workflow non-blocking while we shake it out.

Here is an example PR with breaking changes in clerk/snapi: clerk/break-check#21

Here is a sample of a breaking-change report:

[changeset-bot]

🦋 Changeset detected

Latest commit: a182d1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 27, 2026 3:44pm

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds SNAPI-based API change detection: a new snapi.config.json lists four packages to scan and snapshot settings; a GitHub Actions workflow (api-changes.yml) now runs on push and pull_request for main and release branches, adds a publish-baseline job for push that builds declarations and caches baseline snapshots, and reworks the check-api job for PRs to restore or build baseline snapshots, run snapi detect (failing on breaking changes), and upload api-changes-report.md. The UI package gains a declarations-only tsconfig and a build:declarations script. A changeset entry was updated.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci(repo): dogfood snapi api checks' clearly and concisely describes the main change—setting up the snapi API-checks workflow for testing purposes in the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description clearly explains the purpose of the changes: setting up snapi API-change detection for multiple packages with a GitHub Actions workflow that uses caching and fallback mechanisms.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Line 67: The workflow generates current snapshots to ".api-snapshots-current"
but snapi.config.json uses snapshotDir ".api-snapshots", so update the pnpm dlx
snapi snapshot invocation or the snapi.detect invocation to use the same
directory: either change the snapshot command (the run line that calls "pnpm dlx
--package \"$SNAPI_PACKAGE\" snapi snapshot --output .api-snapshots-current") to
output to ".api-snapshots" or pass the explicit --current flag/--output value to
the "snapi detect" step so it points at ".api-snapshots-current", ensuring the
snapshot generation and detection commands reference the same directory.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9f43cc8f-f375-42fc-a605-7463dfc82b40

📥 Commits

Reviewing files that changed from the base of the PR and between 2f003bc and 741ad85.

📒 Files selected for processing (3)

• .changeset/dogfood-snapi.md
• .github/workflows/api-changes.yml
• snapi.config.json

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8621

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8621

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8621

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8621

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8621

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8621

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8621

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8621

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8621

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8621

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8621

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8621

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8621

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8621

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8621

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8621

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8621

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8621

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8621

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8621

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8621

commit: a182d1c

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 124-127: The fallback fetch uses a moving ref
(origin/${GITHUB_BASE_REF}) which can drift; change the git fetch invocation(s)
that currently use GITHUB_BASE_REF to fetch the immutable PR base SHA
(github.event.pull_request.base.sha) instead so the fallback baseline matches
the PR base commit; update both occurrences of the fetch command in the workflow
to use the PR base SHA when populating refs/remotes/origin/${GITHUB_BASE_REF}.
- Around line 57-61: Update the workflow steps that use actions to pin their
versions to specific commit SHAs and disable persisted credentials: replace both
uses of actions/checkout@v4 (the "Checkout Repo" steps) with the corresponding
actions/checkout@<commit-sha> and add persist-credentials: false under their
with blocks; likewise replace actions/cache/save@v4 and actions/cache/restore@v4
with their pinned commit SHAs (actions/cache/save@<commit-sha>,
actions/cache/restore@<commit-sha>). Ensure you only change the version
specifiers and add the persist-credentials: false key to the checkout steps
while keeping existing keys like filter and show-progress intact.
- Around line 112-120: The baseline cache restore step (id baseline-cache using
actions/cache/restore@v4) must gate rebuilds on an exact cache hit, not partial
matches: change the rebuild condition to check
steps.baseline-cache.outputs.cache-hit != 'true' so any non-exact hit (including
partial matches) triggers the rebuild; when rebuilding, ensure the checkout used
to create the baseline worktree checks out the immutable PR base SHA (use ref:
${{ github.event.pull_request.base.sha }} or GITHUB event value) instead of
GITHUB_BASE_REF; set persist-credentials: false on both actions/checkout steps
to avoid leaking tokens; and pin external actions (actions/cache,
actions/checkout, etc.) to specific commit SHAs instead of floating `@v4` tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: c19b2a18-6732-4ac4-a1ee-d17aff1504ca

📥 Commits

Reviewing files that changed from the base of the PR and between dd6e886 and 7b226d2.

📒 Files selected for processing (4)

• .github/workflows/api-changes.yml
• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

✅ Files skipped from review due to trivial changes (3)

• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 138-139: The workflow currently copies the entire
packages/ui/package.json into .worktrees/snapi-baseline/packages/ui/package.json
which imports PR-head manifest changes; instead update only the
scripts.build:declarations entry in the baseline package.json. In the
.github/workflows/api-changes.yml replace the two cp commands that reference
packages/ui/package.json and .worktrees/snapi-baseline/packages/ui/package.json
with a command that reads packages/ui/package.json, extracts the
"build:declarations" script, and patches
.worktrees/snapi-baseline/packages/ui/package.json to set
.scripts["build:declarations"] to that value (preserving all other fields).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: cc276cc0-8fbe-4284-9389-6221b9dcb1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 7b226d2 and b54cb52.

📒 Files selected for processing (1)

• .github/workflows/api-changes.yml

[jacekradko]

Stands up snapi API-change detection for backend, clerk-js, nextjs, react, shared, and ui. On push to main and the release branches a publish-baseline job writes the snapshot to a sha-keyed GHA cache; PR runs restore from it, falling back to rebuilding from a worktree at pull_request.base.sha on a full miss. Snapi itself is pulled from pkg.pr.new because clerk/snapi is private.

continue-on-error: true on the job keeps the workflow non-blocking while we shake it out.

Here is an example PR with breaking changes in clerk/snapi: clerk/break-check#21

Here is a sample of a breaking-change report:

[changeset-bot]

🦋 Changeset detected

Latest commit: a182d1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 27, 2026 3:44pm

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds SNAPI-based API change detection: a new snapi.config.json lists four packages to scan and snapshot settings; a GitHub Actions workflow (api-changes.yml) now runs on push and pull_request for main and release branches, adds a publish-baseline job for push that builds declarations and caches baseline snapshots, and reworks the check-api job for PRs to restore or build baseline snapshots, run snapi detect (failing on breaking changes), and upload api-changes-report.md. The UI package gains a declarations-only tsconfig and a build:declarations script. A changeset entry was updated.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci(repo): dogfood snapi api checks' clearly and concisely describes the main change—setting up the snapi API-checks workflow for testing purposes in the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description clearly explains the purpose of the changes: setting up snapi API-change detection for multiple packages with a GitHub Actions workflow that uses caching and fallback mechanisms.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Line 67: The workflow generates current snapshots to ".api-snapshots-current"
but snapi.config.json uses snapshotDir ".api-snapshots", so update the pnpm dlx
snapi snapshot invocation or the snapi.detect invocation to use the same
directory: either change the snapshot command (the run line that calls "pnpm dlx
--package \"$SNAPI_PACKAGE\" snapi snapshot --output .api-snapshots-current") to
output to ".api-snapshots" or pass the explicit --current flag/--output value to
the "snapi detect" step so it points at ".api-snapshots-current", ensuring the
snapshot generation and detection commands reference the same directory.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9f43cc8f-f375-42fc-a605-7463dfc82b40

📥 Commits

Reviewing files that changed from the base of the PR and between 2f003bc and 741ad85.

📒 Files selected for processing (3)

• .changeset/dogfood-snapi.md
• .github/workflows/api-changes.yml
• snapi.config.json

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8621

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8621

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8621

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8621

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8621

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8621

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8621

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8621

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8621

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8621

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8621

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8621

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8621

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8621

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8621

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8621

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8621

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8621

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8621

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8621

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8621

commit: a182d1c

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 124-127: The fallback fetch uses a moving ref
(origin/${GITHUB_BASE_REF}) which can drift; change the git fetch invocation(s)
that currently use GITHUB_BASE_REF to fetch the immutable PR base SHA
(github.event.pull_request.base.sha) instead so the fallback baseline matches
the PR base commit; update both occurrences of the fetch command in the workflow
to use the PR base SHA when populating refs/remotes/origin/${GITHUB_BASE_REF}.
- Around line 57-61: Update the workflow steps that use actions to pin their
versions to specific commit SHAs and disable persisted credentials: replace both
uses of actions/checkout@v4 (the "Checkout Repo" steps) with the corresponding
actions/checkout@<commit-sha> and add persist-credentials: false under their
with blocks; likewise replace actions/cache/save@v4 and actions/cache/restore@v4
with their pinned commit SHAs (actions/cache/save@<commit-sha>,
actions/cache/restore@<commit-sha>). Ensure you only change the version
specifiers and add the persist-credentials: false key to the checkout steps
while keeping existing keys like filter and show-progress intact.
- Around line 112-120: The baseline cache restore step (id baseline-cache using
actions/cache/restore@v4) must gate rebuilds on an exact cache hit, not partial
matches: change the rebuild condition to check
steps.baseline-cache.outputs.cache-hit != 'true' so any non-exact hit (including
partial matches) triggers the rebuild; when rebuilding, ensure the checkout used
to create the baseline worktree checks out the immutable PR base SHA (use ref:
${{ github.event.pull_request.base.sha }} or GITHUB event value) instead of
GITHUB_BASE_REF; set persist-credentials: false on both actions/checkout steps
to avoid leaking tokens; and pin external actions (actions/cache,
actions/checkout, etc.) to specific commit SHAs instead of floating `@v4` tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: c19b2a18-6732-4ac4-a1ee-d17aff1504ca

📥 Commits

Reviewing files that changed from the base of the PR and between dd6e886 and 7b226d2.

📒 Files selected for processing (4)

• .github/workflows/api-changes.yml
• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

✅ Files skipped from review due to trivial changes (3)

• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 138-139: The workflow currently copies the entire
packages/ui/package.json into .worktrees/snapi-baseline/packages/ui/package.json
which imports PR-head manifest changes; instead update only the
scripts.build:declarations entry in the baseline package.json. In the
.github/workflows/api-changes.yml replace the two cp commands that reference
packages/ui/package.json and .worktrees/snapi-baseline/packages/ui/package.json
with a command that reads packages/ui/package.json, extracts the
"build:declarations" script, and patches
.worktrees/snapi-baseline/packages/ui/package.json to set
.scripts["build:declarations"] to that value (preserving all other fields).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: cc276cc0-8fbe-4284-9389-6221b9dcb1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 7b226d2 and b54cb52.

📒 Files selected for processing (1)

• .github/workflows/api-changes.yml

[jacekradko]

Stands up snapi API-change detection for backend, clerk-js, nextjs, react, shared, and ui. On push to main and the release branches a publish-baseline job writes the snapshot to a sha-keyed GHA cache; PR runs restore from it, falling back to rebuilding from a worktree at pull_request.base.sha on a full miss. Snapi itself is pulled from pkg.pr.new because clerk/snapi is private.

continue-on-error: true on the job keeps the workflow non-blocking while we shake it out.

Here is an example PR with breaking changes in clerk/snapi: clerk/break-check#21

Here is a sample of a breaking-change report:

[changeset-bot]

🦋 Changeset detected

Latest commit: a182d1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 27, 2026 3:44pm

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds SNAPI-based API change detection: a new snapi.config.json lists four packages to scan and snapshot settings; a GitHub Actions workflow (api-changes.yml) now runs on push and pull_request for main and release branches, adds a publish-baseline job for push that builds declarations and caches baseline snapshots, and reworks the check-api job for PRs to restore or build baseline snapshots, run snapi detect (failing on breaking changes), and upload api-changes-report.md. The UI package gains a declarations-only tsconfig and a build:declarations script. A changeset entry was updated.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci(repo): dogfood snapi api checks' clearly and concisely describes the main change—setting up the snapi API-checks workflow for testing purposes in the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description clearly explains the purpose of the changes: setting up snapi API-change detection for multiple packages with a GitHub Actions workflow that uses caching and fallback mechanisms.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Line 67: The workflow generates current snapshots to ".api-snapshots-current"
but snapi.config.json uses snapshotDir ".api-snapshots", so update the pnpm dlx
snapi snapshot invocation or the snapi.detect invocation to use the same
directory: either change the snapshot command (the run line that calls "pnpm dlx
--package \"$SNAPI_PACKAGE\" snapi snapshot --output .api-snapshots-current") to
output to ".api-snapshots" or pass the explicit --current flag/--output value to
the "snapi detect" step so it points at ".api-snapshots-current", ensuring the
snapshot generation and detection commands reference the same directory.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9f43cc8f-f375-42fc-a605-7463dfc82b40

📥 Commits

Reviewing files that changed from the base of the PR and between 2f003bc and 741ad85.

📒 Files selected for processing (3)

• .changeset/dogfood-snapi.md
• .github/workflows/api-changes.yml
• snapi.config.json

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8621

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8621

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8621

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8621

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8621

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8621

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8621

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8621

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8621

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8621

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8621

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8621

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8621

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8621

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8621

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8621

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8621

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8621

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8621

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8621

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8621

commit: a182d1c

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 124-127: The fallback fetch uses a moving ref
(origin/${GITHUB_BASE_REF}) which can drift; change the git fetch invocation(s)
that currently use GITHUB_BASE_REF to fetch the immutable PR base SHA
(github.event.pull_request.base.sha) instead so the fallback baseline matches
the PR base commit; update both occurrences of the fetch command in the workflow
to use the PR base SHA when populating refs/remotes/origin/${GITHUB_BASE_REF}.
- Around line 57-61: Update the workflow steps that use actions to pin their
versions to specific commit SHAs and disable persisted credentials: replace both
uses of actions/checkout@v4 (the "Checkout Repo" steps) with the corresponding
actions/checkout@<commit-sha> and add persist-credentials: false under their
with blocks; likewise replace actions/cache/save@v4 and actions/cache/restore@v4
with their pinned commit SHAs (actions/cache/save@<commit-sha>,
actions/cache/restore@<commit-sha>). Ensure you only change the version
specifiers and add the persist-credentials: false key to the checkout steps
while keeping existing keys like filter and show-progress intact.
- Around line 112-120: The baseline cache restore step (id baseline-cache using
actions/cache/restore@v4) must gate rebuilds on an exact cache hit, not partial
matches: change the rebuild condition to check
steps.baseline-cache.outputs.cache-hit != 'true' so any non-exact hit (including
partial matches) triggers the rebuild; when rebuilding, ensure the checkout used
to create the baseline worktree checks out the immutable PR base SHA (use ref:
${{ github.event.pull_request.base.sha }} or GITHUB event value) instead of
GITHUB_BASE_REF; set persist-credentials: false on both actions/checkout steps
to avoid leaking tokens; and pin external actions (actions/cache,
actions/checkout, etc.) to specific commit SHAs instead of floating `@v4` tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: c19b2a18-6732-4ac4-a1ee-d17aff1504ca

📥 Commits

Reviewing files that changed from the base of the PR and between dd6e886 and 7b226d2.

📒 Files selected for processing (4)

• .github/workflows/api-changes.yml
• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

✅ Files skipped from review due to trivial changes (3)

• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 138-139: The workflow currently copies the entire
packages/ui/package.json into .worktrees/snapi-baseline/packages/ui/package.json
which imports PR-head manifest changes; instead update only the
scripts.build:declarations entry in the baseline package.json. In the
.github/workflows/api-changes.yml replace the two cp commands that reference
packages/ui/package.json and .worktrees/snapi-baseline/packages/ui/package.json
with a command that reads packages/ui/package.json, extracts the
"build:declarations" script, and patches
.worktrees/snapi-baseline/packages/ui/package.json to set
.scripts["build:declarations"] to that value (preserving all other fields).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: cc276cc0-8fbe-4284-9389-6221b9dcb1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 7b226d2 and b54cb52.

📒 Files selected for processing (1)

• .github/workflows/api-changes.yml

[jacekradko]

Stands up snapi API-change detection for backend, clerk-js, nextjs, react, shared, and ui. On push to main and the release branches a publish-baseline job writes the snapshot to a sha-keyed GHA cache; PR runs restore from it, falling back to rebuilding from a worktree at pull_request.base.sha on a full miss. Snapi itself is pulled from pkg.pr.new because clerk/snapi is private.

continue-on-error: true on the job keeps the workflow non-blocking while we shake it out.

Here is an example PR with breaking changes in clerk/snapi: clerk/break-check#21

Here is a sample of a breaking-change report:

[changeset-bot]

🦋 Changeset detected

Latest commit: a182d1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 27, 2026 3:44pm

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds SNAPI-based API change detection: a new snapi.config.json lists four packages to scan and snapshot settings; a GitHub Actions workflow (api-changes.yml) now runs on push and pull_request for main and release branches, adds a publish-baseline job for push that builds declarations and caches baseline snapshots, and reworks the check-api job for PRs to restore or build baseline snapshots, run snapi detect (failing on breaking changes), and upload api-changes-report.md. The UI package gains a declarations-only tsconfig and a build:declarations script. A changeset entry was updated.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci(repo): dogfood snapi api checks' clearly and concisely describes the main change—setting up the snapi API-checks workflow for testing purposes in the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description clearly explains the purpose of the changes: setting up snapi API-change detection for multiple packages with a GitHub Actions workflow that uses caching and fallback mechanisms.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Line 67: The workflow generates current snapshots to ".api-snapshots-current"
but snapi.config.json uses snapshotDir ".api-snapshots", so update the pnpm dlx
snapi snapshot invocation or the snapi.detect invocation to use the same
directory: either change the snapshot command (the run line that calls "pnpm dlx
--package \"$SNAPI_PACKAGE\" snapi snapshot --output .api-snapshots-current") to
output to ".api-snapshots" or pass the explicit --current flag/--output value to
the "snapi detect" step so it points at ".api-snapshots-current", ensuring the
snapshot generation and detection commands reference the same directory.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9f43cc8f-f375-42fc-a605-7463dfc82b40

📥 Commits

Reviewing files that changed from the base of the PR and between 2f003bc and 741ad85.

📒 Files selected for processing (3)

• .changeset/dogfood-snapi.md
• .github/workflows/api-changes.yml
• snapi.config.json

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8621

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8621

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8621

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8621

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8621

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8621

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8621

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8621

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8621

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8621

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8621

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8621

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8621

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8621

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8621

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8621

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8621

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8621

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8621

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8621

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8621

commit: a182d1c

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 124-127: The fallback fetch uses a moving ref
(origin/${GITHUB_BASE_REF}) which can drift; change the git fetch invocation(s)
that currently use GITHUB_BASE_REF to fetch the immutable PR base SHA
(github.event.pull_request.base.sha) instead so the fallback baseline matches
the PR base commit; update both occurrences of the fetch command in the workflow
to use the PR base SHA when populating refs/remotes/origin/${GITHUB_BASE_REF}.
- Around line 57-61: Update the workflow steps that use actions to pin their
versions to specific commit SHAs and disable persisted credentials: replace both
uses of actions/checkout@v4 (the "Checkout Repo" steps) with the corresponding
actions/checkout@<commit-sha> and add persist-credentials: false under their
with blocks; likewise replace actions/cache/save@v4 and actions/cache/restore@v4
with their pinned commit SHAs (actions/cache/save@<commit-sha>,
actions/cache/restore@<commit-sha>). Ensure you only change the version
specifiers and add the persist-credentials: false key to the checkout steps
while keeping existing keys like filter and show-progress intact.
- Around line 112-120: The baseline cache restore step (id baseline-cache using
actions/cache/restore@v4) must gate rebuilds on an exact cache hit, not partial
matches: change the rebuild condition to check
steps.baseline-cache.outputs.cache-hit != 'true' so any non-exact hit (including
partial matches) triggers the rebuild; when rebuilding, ensure the checkout used
to create the baseline worktree checks out the immutable PR base SHA (use ref:
${{ github.event.pull_request.base.sha }} or GITHUB event value) instead of
GITHUB_BASE_REF; set persist-credentials: false on both actions/checkout steps
to avoid leaking tokens; and pin external actions (actions/cache,
actions/checkout, etc.) to specific commit SHAs instead of floating `@v4` tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: c19b2a18-6732-4ac4-a1ee-d17aff1504ca

📥 Commits

Reviewing files that changed from the base of the PR and between dd6e886 and 7b226d2.

📒 Files selected for processing (4)

• .github/workflows/api-changes.yml
• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

✅ Files skipped from review due to trivial changes (3)

• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 138-139: The workflow currently copies the entire
packages/ui/package.json into .worktrees/snapi-baseline/packages/ui/package.json
which imports PR-head manifest changes; instead update only the
scripts.build:declarations entry in the baseline package.json. In the
.github/workflows/api-changes.yml replace the two cp commands that reference
packages/ui/package.json and .worktrees/snapi-baseline/packages/ui/package.json
with a command that reads packages/ui/package.json, extracts the
"build:declarations" script, and patches
.worktrees/snapi-baseline/packages/ui/package.json to set
.scripts["build:declarations"] to that value (preserving all other fields).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: cc276cc0-8fbe-4284-9389-6221b9dcb1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 7b226d2 and b54cb52.

📒 Files selected for processing (1)

• .github/workflows/api-changes.yml

[jacekradko]

Stands up snapi API-change detection for backend, clerk-js, nextjs, react, shared, and ui. On push to main and the release branches a publish-baseline job writes the snapshot to a sha-keyed GHA cache; PR runs restore from it, falling back to rebuilding from a worktree at pull_request.base.sha on a full miss. Snapi itself is pulled from pkg.pr.new because clerk/snapi is private.

continue-on-error: true on the job keeps the workflow non-blocking while we shake it out.

Here is an example PR with breaking changes in clerk/snapi: clerk/break-check#21

Here is a sample of a breaking-change report:

[changeset-bot]

🦋 Changeset detected

Latest commit: a182d1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 27, 2026 3:44pm

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds SNAPI-based API change detection: a new snapi.config.json lists four packages to scan and snapshot settings; a GitHub Actions workflow (api-changes.yml) now runs on push and pull_request for main and release branches, adds a publish-baseline job for push that builds declarations and caches baseline snapshots, and reworks the check-api job for PRs to restore or build baseline snapshots, run snapi detect (failing on breaking changes), and upload api-changes-report.md. The UI package gains a declarations-only tsconfig and a build:declarations script. A changeset entry was updated.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci(repo): dogfood snapi api checks' clearly and concisely describes the main change—setting up the snapi API-checks workflow for testing purposes in the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description clearly explains the purpose of the changes: setting up snapi API-change detection for multiple packages with a GitHub Actions workflow that uses caching and fallback mechanisms.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Line 67: The workflow generates current snapshots to ".api-snapshots-current"
but snapi.config.json uses snapshotDir ".api-snapshots", so update the pnpm dlx
snapi snapshot invocation or the snapi.detect invocation to use the same
directory: either change the snapshot command (the run line that calls "pnpm dlx
--package \"$SNAPI_PACKAGE\" snapi snapshot --output .api-snapshots-current") to
output to ".api-snapshots" or pass the explicit --current flag/--output value to
the "snapi detect" step so it points at ".api-snapshots-current", ensuring the
snapshot generation and detection commands reference the same directory.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9f43cc8f-f375-42fc-a605-7463dfc82b40

📥 Commits

Reviewing files that changed from the base of the PR and between 2f003bc and 741ad85.

📒 Files selected for processing (3)

• .changeset/dogfood-snapi.md
• .github/workflows/api-changes.yml
• snapi.config.json

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8621

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8621

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8621

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8621

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8621

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8621

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8621

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8621

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8621

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8621

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8621

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8621

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8621

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8621

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8621

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8621

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8621

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8621

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8621

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8621

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8621

commit: a182d1c

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 124-127: The fallback fetch uses a moving ref
(origin/${GITHUB_BASE_REF}) which can drift; change the git fetch invocation(s)
that currently use GITHUB_BASE_REF to fetch the immutable PR base SHA
(github.event.pull_request.base.sha) instead so the fallback baseline matches
the PR base commit; update both occurrences of the fetch command in the workflow
to use the PR base SHA when populating refs/remotes/origin/${GITHUB_BASE_REF}.
- Around line 57-61: Update the workflow steps that use actions to pin their
versions to specific commit SHAs and disable persisted credentials: replace both
uses of actions/checkout@v4 (the "Checkout Repo" steps) with the corresponding
actions/checkout@<commit-sha> and add persist-credentials: false under their
with blocks; likewise replace actions/cache/save@v4 and actions/cache/restore@v4
with their pinned commit SHAs (actions/cache/save@<commit-sha>,
actions/cache/restore@<commit-sha>). Ensure you only change the version
specifiers and add the persist-credentials: false key to the checkout steps
while keeping existing keys like filter and show-progress intact.
- Around line 112-120: The baseline cache restore step (id baseline-cache using
actions/cache/restore@v4) must gate rebuilds on an exact cache hit, not partial
matches: change the rebuild condition to check
steps.baseline-cache.outputs.cache-hit != 'true' so any non-exact hit (including
partial matches) triggers the rebuild; when rebuilding, ensure the checkout used
to create the baseline worktree checks out the immutable PR base SHA (use ref:
${{ github.event.pull_request.base.sha }} or GITHUB event value) instead of
GITHUB_BASE_REF; set persist-credentials: false on both actions/checkout steps
to avoid leaking tokens; and pin external actions (actions/cache,
actions/checkout, etc.) to specific commit SHAs instead of floating `@v4` tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: c19b2a18-6732-4ac4-a1ee-d17aff1504ca

📥 Commits

Reviewing files that changed from the base of the PR and between dd6e886 and 7b226d2.

📒 Files selected for processing (4)

• .github/workflows/api-changes.yml
• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

✅ Files skipped from review due to trivial changes (3)

• packages/ui/package.json
• packages/ui/tsconfig.declarations.json
• snapi.config.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-changes.yml:
- Around line 138-139: The workflow currently copies the entire
packages/ui/package.json into .worktrees/snapi-baseline/packages/ui/package.json
which imports PR-head manifest changes; instead update only the
scripts.build:declarations entry in the baseline package.json. In the
.github/workflows/api-changes.yml replace the two cp commands that reference
packages/ui/package.json and .worktrees/snapi-baseline/packages/ui/package.json
with a command that reads packages/ui/package.json, extracts the
"build:declarations" script, and patches
.worktrees/snapi-baseline/packages/ui/package.json to set
.scripts["build:declarations"] to that value (preserving all other fields).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: cc276cc0-8fbe-4284-9389-6221b9dcb1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 7b226d2 and b54cb52.

📒 Files selected for processing (1)

• .github/workflows/api-changes.yml