docs(changelog): Flaky Tests fork PR uploads without sharing org token

[samgutentag]

What shipped

A per-repo Fork PR Uploads toggle for Flaky Tests (Settings > Repositories > [repo] > Flaky Tests). Enabling it mints a non-secret 8-character public repo identifier that fork PR workflows send on the X-Trunk-Public-Repo-Id header instead of the org API token. Uploads are gated by two independent checks: per-repo opt-in plus GitHub run verification.

Source

• Eng PR: trunk-io/trunk2#3908 (merged 2026-05-18)
• Linear: TRUNK-18349 (no absorbed duplicates)

Date basis

Entry date 2026-05-18 = mergedAt of the source eng PR.

Wired files (4 sites)

• changelog/2026-05-18-flaky-tests-fork-pr-uploads.mdx (entry)
• docs.json (Changelog 2026 nav group)
• changelog/index.mdx (May 2026 Update block)
• flaky-tests/changelog.mdx (product index Update block)

Verification notes

Header name X-Trunk-Public-Repo-Id and the 8-character alphanumeric identifier are both confirmed against trunk2#3908 (TRD + short-id.ts, same alphabet/length as test-collection short IDs). Note: trunk2#3908 ships only the frontend toggle + DB config; the header acceptance on the upload/quarantine endpoints lives in the legacy api.trunk.io monolith and analytics-cli, listed as out-of-scope cross-repo TODOs. Kept as a draft pending confirmation those land in production.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
trunk	🟢 Ready	View Preview	May 29, 2026, 5:41 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[samgutentag]

Verification status (2026-05-29): pending

Eng merged but the customer-facing upload path is not confirmed live in prod. Hold off.

• Flag state: LaunchDarkly not consulted (the settings toggle ships ungated; no flag gates this feature).
• Eng PR: trunk-io/trunk2#3908 (merged 2026-05-18, merge commit intact on main).
• Flag: none.
• Signals: #3908 ships only the Fork PR Uploads settings toggle plus the RepoForkPrUploadsConfig DB row. The actual upload path (the legacy api.trunk.io monolith accepting X-Trunk-Public-Repo-Id with lookup + run verification, and analytics-cli sending the header on fork runs) is an out-of-scope cross-repo TODO in the PR, in separate repos, not confirmed merged or deployed. Slack search after 2026-05-18 returned no rollout confirmation.

Next: keep in draft. Re-run once the monolith accepts the header in prod and analytics-cli ships the fork-PR send path. (Verdict unchanged from prior run.)

[samgutentag]

Code verification (2026-05-28): 3 confirmed / 0 contradicted / 0 ambiguous / 0 unverifiable

Claim	Verdict	Source
Identifier is 8 characters, alphanumeric	confirmed	short-id.ts:5
Header name is X-Trunk-Public-Repo-Id	confirmed	docs/trd/fork-pr-uploads.md
Toggle is "Fork PR Uploads" on the repo Flaky Tests settings page	confirmed	fork-pr-uploads-setting.tsx

All three factual claims in the entry are confirmed against trunk2#3908. One scope note (not a contradiction): the X-Trunk-Public-Repo-Id header is defined as the upload contract in the trunk2 TRD, but the code that accepts it lives in the legacy api.trunk.io monolith and the analytics-cli (out-of-scope cross-repo TODOs in this PR). The header name and the 8-char identifier are correct; the end-to-end receiving path is tracked separately. See the verify-docs-pr comment for the pending rollout verdict.

---

Source #1 — Identifier is 8 characters, alphanumeric (confirmed)

File: trunk-io/trunk2/ts/apps/frontend/src/lib/services/flaky-tests/short-id.ts#L1-L10

import { customAlphabet } from "nanoid";

const SHORT_ID_ALPHABET =
  "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
const SHORT_ID_LENGTH = 8;

export const generateShortId = customAlphabet(
  SHORT_ID_ALPHABET,
  SHORT_ID_LENGTH,
);

Reasoning: The public repo identifier is minted by generateShortId() (called as publicRepoIdentifier: generateShortId() in the fork-pr-uploads service). SHORT_ID_LENGTH = 8 and the alphabet is 0-9A-Za-z, so "8-character" and "alphanumeric" are both exact. The e2e test asserts the rendered value matches /^[0-9A-Za-z]{8}$/, confirming the same length at the UI layer.

Source #2 — Header name is X-Trunk-Public-Repo-Id (confirmed)

File: trunk-io/trunk2/docs/trd/fork-pr-uploads.md

A non-secret, opt-in, per-repo public identifier that the analytics-cli sends on fork PR runs.
The customer-facing endpoints (in the legacy `api.trunk.io` monolith) accept the identifier on
`X-Trunk-Public-Repo-Id` and gate uploads + quarantine reads on per-repo opt-in plus run verification.

Reasoning: The header name is spelled X-Trunk-Public-Repo-Id consistently across the TRD (contract definition, the analytics-cli send path, and the monolith handler section). Trap to flag: the handler that reads this header is not in this PR's diff. It lives in the legacy monolith (out-of-scope TODO), so the name is confirmed as the contract while the receiving implementation ships separately.

Source #3 — Toggle is "Fork PR Uploads" on the repo Flaky Tests settings page (confirmed)

File: trunk-io/trunk2/ts/apps/frontend/src/components/settings/flaky-tests/fork-pr-uploads-setting.tsx

    <SettingsSection title="Fork PR Uploads">

Reasoning: The setting renders inside a SettingsSection titled "Fork PR Uploads", matching the entry's section name. The e2e test (flaky-tests-settings.pwtest.ts) navigates to the repo's flaky-tests settings page and flips this toggle, confirming the placement under Settings > Repositories > [repo] > Flaky Tests. The user-facing toggle copy itself is "Accept uploads from fork PRs"; the entry refers to the section name, which is accurate.

[samgutentag]

Verification status (May 30, 2026): live

Verified: customers can use this. Ready to publish.

• Flag state: LaunchDarkly not consulted (no flag gates this feature; all three components are ungated).
• Eng PR: trunk-io/trunk2#3908 (merged 2026-05-18, intact on main). Cross-repo deps now both merged: trunk-io/trunk#31970 "Accept X-Trunk-Public-Repo-Id on flaky-tests upload + quarantine endpoints" (merged 2026-05-28) and Support uploading from forked-repo PRs via x-trunk-public-repo-id analytics-cli#1101 "Support uploading from forked-repo PRs via x-trunk-public-repo-id" (merged 2026-05-29).
• Flag: none.
• Signals: Slack #merge-notifications confirmed analytics-cli#1101 merged 2026-05-29 at 11:48 PDT by Matt Matheson; trunk#31970 merged 2026-05-28. All three components of the fork PR upload path (frontend settings toggle, monolith acceptance, CLI sending the header) are now merged.

Prior verdict was pending because the cross-repo TODOs were unresolved. Both have now landed. The complete end-to-end fork PR upload path is live. Note: PR #33 documents the same feature with overlapping content on the same page. Coordinate with the author before publishing to avoid duplicate sections.

---

Generated by Claude Code

[samgutentag]

Verification status (May 31, 2026): live

All three cross-repo dependencies have merged; this changelog is clear to ship.

• Flag state: not consulted
• Eng PRs: trunk2#3908 (merged May 18), trunk#31970 (merged May 28), analytics-cli#1101 (merged May 29)
• Flag: none
• Signals: all blocking eng work landed; feature available in prod since May 30

Next action: merge this PR.

---

Generated by Claude Code

[samgutentag]

Docs Verify Sweep · June 1, 2026 · ✅ live

Feature is live in production. Ready to merge.

Unchanged from previous sweep (May 31, 2026).

---

Generated by Claude Code