From 83cb7cb0957802a35c26b69e2dfc2a3e15e04785 Mon Sep 17 00:00:00 2001
From: Ioannis J <yiannis@posthog.com>
Date: Tue, 1 Sep 2026 13:40:53 +0300
Subject: [PATCH 1/2] fix: notify Slack when a release is rejected at the
 approval gate

---
 .github/workflows/release.yml | 41 +++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c1ac3ff5..19bdca42 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -527,3 +527,44 @@ jobs:
           thread_ts: ${{ needs.notify-approval-needed.outputs.slack_ts }}
           message: "🚀 posthog-python released successfully!"
           emoji_reaction: "rocket"
+
+  notify-rejected:
+    name: Notify Slack - Rejected
+    needs: [version-bump, notify-approval-needed]
+    runs-on: ubuntu-latest
+    if: always() && needs.version-bump.result == 'failure' && needs.notify-approval-needed.outputs.slack_ts != ''
+    permissions:
+      actions: read
+    steps:
+      - name: Check for rejection
+        id: check-rejection
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          RESPONSE=$(gh api /repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/approvals)
+          REJECTED=$(echo "$RESPONSE" | jq '[.[] | select(.state == "rejected")] | length')
+          if [ "$REJECTED" -gt 0 ]; then
+            echo "was_rejected=true" >> "$GITHUB_OUTPUT"
+            COMMENT=$(echo "$RESPONSE" | jq -r '.[] | select(.state == "rejected") | .comment // empty' | head -1)
+            if [ -n "$COMMENT" ]; then
+              {
+                echo 'message<<EOF'
+                echo "🚫 Release was rejected: $COMMENT"
+                echo 'EOF'
+              } >> "$GITHUB_OUTPUT"
+            else
+              echo "message=🚫 Release was rejected." >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "was_rejected=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Notify Slack - Rejected
+        if: steps.check-rejection.outputs.was_rejected == 'true'
+        uses: posthog/.github/.github/actions/slack-thread-reply@cb0979b67dcd585828b61ac45927eef4da8f6287 # main
+        with:
+          slack_bot_token: ${{ secrets.SLACK_CLIENT_LIBRARIES_BOT_TOKEN }}
+          slack_channel_id: ${{ vars.SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID }}
+          thread_ts: ${{ needs.notify-approval-needed.outputs.slack_ts }}
+          message: "${{ steps.check-rejection.outputs.message }}"
+          emoji_reaction: "no_entry_sign"

From d6087afc3922186947b7686e011f6457d40ca543 Mon Sep 17 00:00:00 2001
From: Ioannis J <yiannis@posthog.com>
Date: Tue, 1 Sep 2026 14:47:02 +0300
Subject: [PATCH 2/2] fix: keep multiline rejection comments intact in the
 Slack notification

---
 .github/workflows/release.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 19bdca42..91e06996 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -545,12 +545,16 @@ jobs:
           REJECTED=$(echo "$RESPONSE" | jq '[.[] | select(.state == "rejected")] | length')
           if [ "$REJECTED" -gt 0 ]; then
             echo "was_rejected=true" >> "$GITHUB_OUTPUT"
-            COMMENT=$(echo "$RESPONSE" | jq -r '.[] | select(.state == "rejected") | .comment // empty' | head -1)
+            COMMENT=$(echo "$RESPONSE" | jq -r 'first(.[] | select(.state == "rejected") | .comment // empty)')
             if [ -n "$COMMENT" ]; then
+              # Random delimiter: a rejection comment is reviewer-controlled text, and a
+              # literal delimiter line inside it would close the block early and let the
+              # rest be parsed as step outputs.
+              DELIMITER="EOF_$(openssl rand -hex 16)"
               {
-                echo 'message<<EOF'
+                echo "message<<$DELIMITER"
                 echo "🚫 Release was rejected: $COMMENT"
-                echo 'EOF'
+                echo "$DELIMITER"
               } >> "$GITHUB_OUTPUT"
             else
               echo "message=🚫 Release was rejected." >> "$GITHUB_OUTPUT"